# Uploaded files must NEVER be executable, no matter what extension a
# malicious upload is disguised with. This is the single most important
# .htaccess in the project.

<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_admin_flag engine off
</IfModule>

# Belt-and-braces for php-fpm setups (mod_php directives above don't apply):
<FilesMatch "\.(php|phtml|php\d?|phar|cgi|pl)$">
    Require all denied
</FilesMatch>

Options -ExecCGI -Indexes
AddType text/plain .php .phtml .php3 .php4 .php5 .php7 .phar
