# Protect helper files — only contact.php / careers.php should be called
<FilesMatch "^(helpers\.php)$">
  Require all denied
</FilesMatch>