# Defense-in-depth: even though upload_photo.php only accepts
# JPG/PNG/WEBP by real MIME type (not just file extension), this file
# ensures nothing inside /uploads/ can ever be executed as a script,
# regardless of extension.

<FilesMatch "\.(php|phtml|php3|php4|php5|phar|cgi|pl)$">
    Require all denied
</FilesMatch>

Options -ExecCGI
