# Second layer of defense: never execute PHP from inside uploads,
# even if the root .htaccess is ever misconfigured or bypassed.
<FilesMatch "\.(php|phtml|php\d|phar)$">
  Require all denied
</FilesMatch>
Options -Indexes -ExecCGI
