# User-uploaded content: never execute as PHP.
# Uses <FilesMatch> + <IfModule> so it works with both mod_php and PHP-FPM.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
RemoveHandler .php .phtml .php3 .php4 .php5 .php7
RemoveType .php .phtml
<FilesMatch "\.(php|phtml|phar|pht|php5|php7|shtml)$">
    Require all denied
</FilesMatch>
Options -Indexes