# Defense in depth for Apache deployments: uploaded files are data, never code.
Options -ExecCGI -Indexes

<FilesMatch "\.(?:php[0-9]?|phtml|phar|cgi|pl|py|sh)$">
    Require all denied
</FilesMatch>
