# Uploaded photos are user-generated content — never let this folder execute code,
# no matter what filename/extension ends up here.
php_flag engine off
<FilesMatch "\.(php|phtml|php\d?|phar|cgi|pl)$">
  Require all denied
</FilesMatch>
Options -ExecCGI -Indexes
