private function maybe_create_htaccess( $folder ) {

		if (
			! $folder
			|| ! is_dir( $folder )
			|| ! is_writable( $folder )
			|| file_exists( "{$folder}/.htaccess" )
			|| ! defined( 'WP_CONTENT_DIR' )
		) {
			return $folder;
		}

		$target_dir  = realpath( $folder );
		$content_dir = realpath( WP_CONTENT_DIR );

		// Sorry, we can't allow logs to be put straight in content folder. That's too dangerous.
		if ( $target_dir === $content_dir ) {
			$target_dir .= DIRECTORY_SEPARATOR . 'wonolog';
		}

		// If target dir is outside content dir, its security is up to user.
		if ( strpos( $target_dir, $content_dir ) !== 0 ) {
			return $target_dir;
		}

		// Let's disable error reporting: too much file operations which might fail, nothing can log them, and package
		// is fully functional even if failing happens. Silence looks like best option here.
		set_error_handler( '__return_true' );

		$handle = fopen( "{$folder}/.htaccess", 'w' );

		if ( $handle && flock( $handle, LOCK_EX ) ) {
			$htaccess = <<<'HTACCESS'
<IfModule mod_authz_core.c>
	Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
	Deny from all
</IfModule>
HTACCESS;

			if ( fwrite( $handle, $htaccess ) ) {
				flock( $handle, LOCK_UN );
				chmod( "{$folder}/.htaccess", 0444 );
			}
		}

		fclose( $handle );

		restore_error_handler();

		return $target_dir;
	}