diff --git a/dev/install/install.php5 b/dev/install/install.php5
index d3ec3783e..ae333d319 100644
--- a/dev/install/install.php5
+++ b/dev/install/install.php5
@@ -1268,6 +1268,13 @@ HTML;
 	Deny from all
 </Files>
 
+# This denies access to all yml files, since developers might include sensitive
+# information in them. See the docs for work-arounds to serve some yaml files
+<Files *.yml>
+	Order allow,deny
+	Deny from all
+</Files>
+
 ErrorDocument 404 /assets/error-404.html
 ErrorDocument 500 /assets/error-500.html