# ============================================================
# Upload sandbox — files here are DATA, never executable code.
# ============================================================
# Even if an attacker slips a .php file past validation, Apache must never run
# it. The FilesMatch deny is authoritative regardless of PHP SAPI/module name.
<FilesMatch "\.(php|php[0-9]?|phtml|pht|phar|phps|shtml|cgi|pl|py|jsp|jspx|asp|aspx|sh|bat|cmd|exe|dll|so)$">
    Require all denied
</FilesMatch>

# No directory listings.
Options -Indexes

# Belt-and-braces: switch off the PHP engine for this tree when mod_php is used.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>
