# Uploaded files are DATA, never code. Even if a malicious file slipped past
# validation, it must never execute on this server.
<FilesMatch "\.(php|phtml|php[0-9]|phar|pl|py|cgi|sh|asp|aspx|jsp)$">
  Require all denied
</FilesMatch>
Options -ExecCGI -Indexes
