Options -Indexes

# Never execute code from uploads
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|php8|phar|cgi|pl|py|sh|exe|jsp|asp|aspx)$">
    <IfModule mod_authz_core.c>
    Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
    Deny from all
    </IfModule>
</FilesMatch>
