# Media directory: serve images only, never execute scripts.
Require all denied
<FilesMatch "\.(?i:jpe?g|png|gif|webp|avif)$">
    Require all granted
</FilesMatch>

# Neutralize PHP however the host runs it.
RemoveHandler .php .phtml .phar
RemoveType .php .phtml .phar
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
