# Defense in depth for the uploads folder.
#
# Uploads are already validated server-side (real image type checked via
# getimagesize(), extension forced from that result, filename generated
# rather than taken from the upload) — so a script shouldn't be able to
# land here in the first place. These rules make sure that even if one
# somehow did, the server would never execute it.

# Never run anything as a script in here.
php_flag engine off
<IfModule mod_php.c>
    php_admin_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_admin_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_admin_flag engine off
</IfModule>

RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phps
RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8 .phps
AddType text/plain .php .phtml .php3 .php4 .php5 .php7 .php8 .phps

# Serve only real image types from here; block everything else.
<FilesMatch "\.(?!(jpe?g|png|gif|webp)$)[^.]+$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

Options -Indexes -ExecCGI
