# Serve these files, never execute them. Also written at runtime by
# uploads.php, because FTP clients routinely skip hidden files — and a missing
# copy of this is the difference between an image store and a remote shell.
php_flag engine off
AddType text/plain .php .phtml .php3 .php4 .php5 .php7 .php8 .phps .cgi .pl .py
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phps .cgi .pl .py
Options -ExecCGI -Indexes

<FilesMatch "\.(?i:jpe?g|png|webp)$">
    Require all granted
</FilesMatch>
<FilesMatch "^(?!.*\.(?i:jpe?g|png|webp)$)">
    Require all denied
</FilesMatch>
