I installed whmcs on OLS aapanel, there are 2 htaccess files, 1 in the domain directory, and another in the /domain directory/vendor which contains "deny from all", it should make the vendor inaccessible via a web browser, but it can still be accessed