general setting

deny access directory

.htaccess

Deny from all

deny access root file

<Files config.php>
    order allow,deny
    deny from all
    Require all denied
</Files>

Don’t allow list file of directory

Options -Indexes

Virtualmin symlink not allow apache error

use

Options SymLinksIfOwnerMatch 

in place of

Options +FollowSymLinks

REF: [https://www.virtualmin.com/comment/732405#comment-732405]