# Uploads are data, never code. Neutralise any handler that would execute a
# file planted here, and stop Apache negotiating e.g. shell.php.jpg into PHP.
#
# php_flag MUST stay wrapped: it is a mod_php directive, and Apache returns
# "500 Internal Server Error - misconfiguration" for every request in this
# directory when PHP runs as CGI/FastCGI/LiteSpeed, which is how most shared
# hosts are configured. Unwrapped, this file made every property image on the
# site 500 while directories without an .htaccess served fine.
#
# Losing php_flag on those servers costs nothing: PHP is not handled by
# mod_php there, so the engine was never going to run from this directory
# anyway, and RemoveHandler/RemoveType below are the directives that actually
# stop a planted .php file being executed.
<IfModule mod_php.c>
  php_flag engine off
</IfModule>
<IfModule mod_php7.c>
  php_flag engine off
</IfModule>
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phar .pl .py .cgi
RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8 .phar
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
</IfModule>
<IfModule mod_mime.c>
  AddType image/webp .webp
  AddType image/avif .avif
  AddType image/svg+xml .svg
</IfModule>
Options -ExecCGI -Indexes -MultiViews
