# Uploads directory hardening
# This folder holds user-uploaded logo/favicon images ONLY. Never allow any
# server-side script here to be executed (protects against a malicious upload).

# No directory listing
Options -Indexes -ExecCGI

# Deny access to any script-like file, regardless of server/PHP handler
<FilesMatch "\.(php|php3|php4|php5|php7|pht|phtml|phar|pl|py|cgi|sh|lua|asp|aspx|htaccess)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Allow,Deny
        Deny from all
    </IfModule>
</FilesMatch>

# Force anything that slips through to be served as plain text, never executed
RemoveHandler .php .php3 .php4 .php5 .php7 .phtml .phar .pl .py .cgi
AddType text/plain .php .php3 .php4 .php5 .php7 .phtml .phar .pl .py .cgi
