Options -Indexes

# Uploaded files are data only. Block every executable/server-side extension.
<FilesMatch "(?i)\.(php[0-9]?|phtml|phar|cgi|pl|py|sh|shtml|fcgi|jsp|asp|aspx|htaccess|user\.ini)$">
  Require all denied
</FilesMatch>

<IfModule mod_php.c>
  php_flag engine off
</IfModule>
RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .cgi .pl .py .sh .shtml
RemoveType .php .php3 .php4 .php5 .php7 .php8 .phtml .phar
AddType text/plain .php .php3 .php4 .php5 .php7 .php8 .phtml .phar

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Content-Security-Policy "default-src 'none'; img-src 'self'; style-src 'unsafe-inline'"
</IfModule>
