# User-uploaded files live under here (report photos, tip/news images).
# handle_image_upload() (includes/functions.php) already validates real
# MIME type + image decoding and writes random, extension-locked filenames,
# but a misconfigured server or a future upload feature is one mistake away
# from executable content landing here — so this folder never executes
# anything, no matter what gets uploaded to it.

php_flag engine off

<IfModule mod_php.c>
  php_admin_flag engine off
</IfModule>
<IfModule mod_php7.c>
  php_admin_flag engine off
</IfModule>

<FilesMatch "\.(php|php3|php4|php5|php7|phtml|pht|phar|cgi|pl|py|sh|asp|aspx)$">
  Require all denied
</FilesMatch>

Options -Indexes -ExecCGI
AddType text/plain .php .php3 .php4 .php5 .phtml .pht .phar .cgi .pl .py .sh
