# Serve uploads as files only — never execute them.
#
# This folder normally sits above the web root, where the web server never
# looks, and photographs are read through photo.php behind the login. These
# rules are for the case where it ends up inside the web root.
#
# php_flag is only understood by mod_php. On PHP-FPM or LiteSpeed — what
# most cPanel hosts run — an unguarded php_flag line is a 500 error, so it
# is wrapped for each mod_php version.
<IfModule mod_php7.c>
  php_flag engine off
</IfModule>
<IfModule mod_php.c>
  php_flag engine off
</IfModule>

RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phar
RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8 .phar

<FilesMatch "\.(?i:php|phtml|php[3-8]|phar|cgi|pl|py|sh|htaccess)$">
  Require all denied
</FilesMatch>

# Nobody browses straight to a child's photograph.
Require all denied
