In my apache server I don't want to serve any files with extensions .config because it could contain potentially sensitive information. In my apache2.conf file I added:
<FilesMatch "\.config"> Require all denied </FilesMatch>
Then I restarted Apache and tested. It works. Almost. None of the files db.config, redirect.config, UrlTypes.config or hidden.config are served, which was the point BUT, one file named web.config is served (it lies in the same directory as the others). Why, and what is so special with web.config that doesn't follow the indications?