# Same PHP-execution lock as uploads/.htaccess, applied here as cheap defense in depth —
# og-cache/ only ever holds server-generated .jpg derivatives (see og_safe_image_path() in
# includes/functions.php), never a directly user-uploaded file, but there's no reason not
# to hold it to the same standard.
<IfModule mod_authz_core.c>
    # Apache 2.4+
    <FilesMatch "\.(php|phtml|php[0-9]|pht|phar)$">
        Require all denied
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    # Apache 2.2
    <FilesMatch "\.(php|phtml|php[0-9]|pht|phar)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
