# Uploaded files must NEVER execute as code (defense-in-depth behind the
# upload extension allowlist). Apache 2.4 syntax.
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|pht|phar|cgi|pl|py|sh)$">
    Require all denied
</FilesMatch>

# Disable any script engines in this directory
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .phps .pht .phar
RemoveType .php .phtml .php3 .php4 .php5 .php7 .phps .pht .phar
php_flag engine off

# Serve everything as a download attachment where possible
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
</IfModule>
