Config!
Having run Apache for about 18 years at home, and built from source in the last 12 years, the default httpd.conf has (ignore blank lines):
<Directory />
AllowOverride none
Require all denied
</Directory>
Unless you override this then you need to know what you doing (or not, it seems if some people are being hit with this).
Biting the hand that feeds IT
