# Allow images only — block script execution in uploads
<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|sh|cgi)$">
  Require all denied
</FilesMatch>
Options -Indexes
