# This directory only ever holds user-uploaded images (profile photos,
# notice-board attachments). Never execute anything here as a script,
# even if a bad file extension slips past application-level validation.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<FilesMatch "\.(php|php\d|phtml|phar|pl|py|cgi|asp|aspx|sh)$">
    Require all denied
</FilesMatch>
