For security reasons, we block access to certain files when accessed from the web.
Full list of things that are blocked:
# wp-config.php and variations thereof
wp-config.php
wp-config.php.*
wp-config-sample.php
# .php files in uploads folder
wp-content/uploads/*.php
# backup extensions and log files
*.bak
*.log
*.old
*.orig
*.original
*.php#
*.php~
*.php_bak
*.save
*.swo
*.swp
*.sql
*.imported
# log files
*.log.x (where x is a number)
*.log.x.gz (where x is a number)