[vacri]

> If you read the docs on Order

That's yet another example of apache config violating POLS (Principle Of Least Astonishment). You have a set of Allow rules and a set of Deny rules. If a request does not match a rule in either set, then what happens to the request depends on the ordering of these non-matching rulesets (!!) instead of a reasonable default with an explicitly configured alternate option.

It's also a bad name - there's no hint that this affects the default action; you just have to know ahead of time.