When you add a directory exception, here's how it works. When you tell it to allow access to components/com_foobar/something then all contents of the components/com_foobar/something directory in your site's root and all of the contents in its subdirectories are accessible,
except for PHP files.
Here's you to test it. First, create a small file called test.php containing this:
<?php echo('You should never see this message');
and upload into this directory you have allowed. Then, in your browser, try accessing http://www.example.com/components/com_foobar/something/test.php (where example.com is the domain name of your site). You should get a 403 Forbidden reply. If you see "You should never see this message" check your settings as it's something that should never happen on a site where .htaccess Maker has run and there was no exception which allows PHP files to run applied in its configuration.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!