# Block any script execution in uploads directory.
# Only static assets (images) should be served from here.

<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

# Remove handlers
RemoveHandler .php .php3 .php4 .php5 .php7 .phtml .phar .pl .py .jsp .asp .sh .cgi
RemoveType .php .php3 .php4 .php5 .php7 .phtml .phar .pl .py .jsp .asp .sh .cgi

# Set a safe default handler
AddType text/plain .php .php3 .php4 .php5 .php7 .phtml .phar .pl .py .jsp .asp .sh .cgi

# No directory listing
Options -Indexes -ExecCGI

# Only allow image MIME types
<FilesMatch "\.(?i:jpg|jpeg|png|gif|webp|svg|avif)$">
    Require all granted
</FilesMatch>
<FilesMatch "\.(?i:php|phar|phtml|pl|py|jsp|asp|sh|cgi|htaccess|htpasswd)$">
    Require all denied
</FilesMatch>
