# ============================================================
# SECURITY GUARD: Disable Script Execution in Uploads Directory
# ============================================================

# 1. Disable PHP script engine if mod_php is active
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

# 2. Force all files to be served as static files, never CGI or scripts
SetHandler default-handler
Options -ExecCGI -Indexes

# 3. Deny access to dangerous script extensions completely
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|php8|phps|phar|sh|exe|bat|cmd|cgi|pl|py|htaccess|env|config)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# 4. Header security for static files
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
</IfModule>
