# =============================================================================
# SECURITY: Deny execution of scripts in upload directories
# =============================================================================

# Block access to dangerous file types
<FilesMatch "\.(php|php3|php4|php5|php7|php8|phtml|phar|py|pl|sh|bash|cgi|exe|bat|cmd|asp|aspx|jsp|rb|jar|ps1)$">
    Require all denied
</FilesMatch>

# Disable PHP engine entirely in this directory and all subdirectories
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

# Force files to be served as their declared MIME type only
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
</IfModule>

# Prevent directory listing
Options -Indexes

# Deny access to hidden files
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
