# Belt-and-suspenders against the upload validation in handle_image_upload() ever being
# bypassed or regressing: even if a PHP file somehow ends up in this folder (or any
# subfolder — Apache applies this recursively), it's served as inert static text, never
# executed as code. Same protection WordPress ships by default in wp-content/uploads/.
# Both blocks are included since we can't assume which Apache version a given shared
# host runs; only the one whose module is actually loaded applies.
<IfModule mod_authz_core.c>
    # Apache 2.4+
    <FilesMatch "\.(php|phtml|php[0-9]|pht|phar)$">
        Require all denied
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    # Apache 2.2
    <FilesMatch "\.(php|phtml|php[0-9]|pht|phar)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
