# Defense in depth: even though uploaded files are validated (real image
# content, extension forced from detected MIME type, random filenames),
# this ensures nothing in /uploads/ can ever be executed as a script —
# so a disguised upload can't become a working PHP shell.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<FilesMatch "\.(php|phtml|php\d?|phar)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</FilesMatch>
