# Uploaded images are data, never code.
#
# Files here arrive from the admin post editor. App\Core\Upload already refuses
# anything whose bytes don't decode as JPG/PNG/WebP/GIF and renames every file,
# but this is the second lock: even if something executable landed in this
# directory, the server must refuse to run it.

# Strip any inherited PHP handler (the project root .htaccess sets one for cPanel).
RemoveHandler .php .phtml .phar .php3 .php4 .php5 .php7 .php8 .cgi .pl .py .sh
RemoveType .php .phtml .phar .php3 .php4 .php5 .php7 .php8 .cgi .pl .py .sh
AddType text/plain .php .phtml .phar .php3 .php4 .php5 .php7 .php8 .cgi .pl .py .sh

<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule php_module>
    php_flag engine off
</IfModule>

# Belt and braces: refuse to serve script-ish files at all.
<FilesMatch "(?i)\.(php|phtml|phar|php[0-9]|cgi|pl|py|sh|htaccess|htpasswd)$">
    Require all denied
</FilesMatch>

Options -ExecCGI -Indexes
