# Customer-uploaded files live here. Nothing in this directory may ever
# be executed — a .php file uploaded through a bypassed validator must
# still be inert.
<IfModule mod_php.c>
  php_flag engine off
</IfModule>
<IfModule mod_rewrite.c>
  RewriteEngine Off
</IfModule>

RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phar .cgi .pl .py
RemoveType    .php .phtml .php3 .php4 .php5 .php7 .php8 .phar
AddType text/plain .php .phtml .phar .cgi .pl .py .html .htm .shtml

Options -ExecCGI -Indexes

# Deny direct web access entirely. Files are delivered as e-mail
# attachments; nothing needs to serve them over HTTP.
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
  Order allow,deny
  Deny from all
</IfModule>
