# Uploaded files are static assets only — never execute PHP from here.
<FilesMatch "\.(php|phtml|php\d)$">
    Require all denied
</FilesMatch>
