@tested0002 sample config updated to:
since in original apache .htaccess there is a deny for all xml files i think it's better to stick with that rule.
Code:
# this blocks direct access to XML files (but sitemap.xml) - they hold all the data
location ~* \.xml$ { deny all; }
location = /sitemap.xml { allow all; }
since in original apache .htaccess there is a deny for all xml files i think it's better to stick with that rule.