# Defense in depth: uploads/ should only ever contain images, but if an
# attacker ever managed to get a file with executable content past
# upload.php's validation, this ensures the webserver serves it as a
# static file (or refuses it) rather than executing it as a script.
Options -Indexes -ExecCGI
AddHandler cgi-script .php .phtml .php3 .php4 .php5 .php7 .phar .pl .py .cgi .asp .aspx .sh .rb
Options -ExecCGI

<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar|pl|py|cgi|asp|aspx|sh|rb)$">
    Require all denied
</FilesMatch>
