# Security: even though only .jpg/.jpeg/.png are accepted on upload, this
# ensures nothing in this folder can ever be executed as a script - two
# layers combined, since different hosting setups honor different methods.

# Layer 1: works regardless of how PHP is invoked (mod_php, CGI, FastCGI,
# CloudLinux Alt-PHP, etc.) - blocks the request outright at the web server
# level before PHP is ever considered. Most reliable on this specific host.
<FilesMatch "\.(php|php\d|phtml|pht)$">
    Require all denied
</FilesMatch>
<IfModule !mod_authz_core.c>
    <FilesMatch "\.(php|php\d|phtml|pht)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

# Layer 2: traditional mod_php-specific protection - kept as a second layer
# in case this or a future host handles PHP that way instead.
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_admin_flag engine off
</IfModule>
RemoveHandler .php .phtml .php3 .php4 .php5 .php7
RemoveType .php .phtml .php3 .php4 .php5 .php7
