# Uploaded files must be served as static assets only — never executed as scripts.
<FilesMatch "\.(php|phtml|php\d?|pl|py|cgi|sh)$">
    Require all denied
</FilesMatch>
Options -Indexes -ExecCGI
