# Protect uploaded files: never execute them, never list them, and never serve

# them raw over HTTP. The application reads them from disk with PHP and renders

# a highlighted view instead.

# Disable PHP execution (covers several handler configs).

<IfModule mod_php.c>

    php_flag engine off

</IfModule>

<IfModule mod_php7.c>

    php_flag engine off

</IfModule>

<IfModule mod_php8.c>

    php_flag engine off

</IfModule>

# Also neutralise scripts by handler, in case the engine flag is unavailable.

RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .phps .cgi .pl .py

AddType text/plain .php .phtml .php3 .php4 .php5 .php7 .phps

Options -Indexes

Require all denied