# Block PHP execution in uploads (prevent uploaded shells)
<FilesMatch "\.php$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block PHP in uploads subdirectories too
<FilesMatch "\.php[0-9]?$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block common exploit file types
<FilesMatch "\.(phtml|php3|php4|php5|php7|phar|inc|pl|py|cgi|asp|aspx|jsp|sh|bash|cmd|exe)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Disable directory listing
Options -Indexes
