# Uploaded files are data, not code. This file is the last line of defence
# against someone who gets an image with a .php extension through the media
# library.

Options -Indexes -ExecCGI

# Strip every handler association from PHP-ish names before they are served.
RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .cgi .pl .py .sh
RemoveType .php .phtml .phar

<IfModule mod_mime.c>
    AddType text/plain .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .cgi .pl .py .sh
</IfModule>

<IfModule mod_php.c>
    php_flag engine off
</IfModule>

<FilesMatch "\.(php|php[0-9]|phtml|phar|cgi|pl|py|sh)$">
    Require all denied
</FilesMatch>

# Never inline-render an uploaded document as HTML.
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set Content-Security-Policy "default-src 'none'"
</IfModule>
