# Admin panel - protect non-PHP files
<FilesMatch "^(?!login\.php|admin\.css)">
    # Additional protection can be added here
    # e.g., IP restriction:
    # Order Deny,Allow
    # Deny from all
    # Allow from YOUR_IP
</FilesMatch>