# Images only. Nothing here may ever execute.
#
# An uploads folder that can run PHP is how sites get taken over: someone
# uploads a .php disguised as a .jpg and calls it. Even though the upload
# handler validates types, this is the backstop that makes that attack
# impossible regardless of what gets past validation.

php_flag engine off

<IfModule mod_php.c>
  php_admin_flag engine off
</IfModule>
<IfModule mod_php7.c>
  php_admin_flag engine off
</IfModule>
<IfModule mod_php8.c>
  php_admin_flag engine off
</IfModule>

# Belt and braces: refuse to hand back anything script-like.
<FilesMatch "\.(php|phar|phtml|php[0-9]|pl|py|cgi|sh|htaccess)$">
  Require all denied
</FilesMatch>

# Serve images as images, never as something a browser might run.
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set Content-Disposition "inline"
</IfModule>

Options -ExecCGI -Indexes
AddType image/jpeg .jpg .jpeg
AddType image/png .png
AddType image/webp .webp
