# Prevent any PHP or server-side script execution inside uploaded assets
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phps .cgi .pl .py .sh
Options -ExecCGI -Indexes

<FilesMatch "\.(php|phtml|phar|pl|py|cgi|sh|exe|bat|cmd|js|html|htm|svg)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</FilesMatch>
