# Uploaded files are data, never code: block script execution in this folder.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<FilesMatch "\.(?i:php\d?|phtml|phar|pl|py|cgi|sh|shtml|html?|svg|js)$">
    Require all denied
</FilesMatch>
Options -Indexes -ExecCGI

# Serve files only as their declared type (a .txt is never run as HTML).
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
</IfModule>
