Yes, running apache. The other rules in htaccess (e.g. WordPress pretty URLs) work fine. I tried blocking my own IP (deny from …) and was still able to access the site. I also checked that when I introduce a typo in the block (e.g. <FilesMatc>), the server throws an error 500, showing that the block is not ignored.