# ====================================================================
# Uploads Security Hardening for Apache / cPanel / Phusion Passenger
# Defense-in-Depth: Prevents execution of scripts in uploads directory
# ====================================================================

# Disable script execution engines (PHP 5/7/8)
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

# Disable CGI execution and directory indexing
<IfModule mod_options.c>
    Options -ExecCGI -Indexes
</IfModule>

# Remove script handlers so files are never treated as executable code
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .cgi .pl .py .sh .jsp .asp .aspx
RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8 .cgi .pl .py .sh .jsp .asp .aspx

# Explicitly deny access to any script or executable file types
<FilesMatch "\.(?i:php|phtml|php[0-9]|cgi|pl|py|sh|bash|jsp|asp|aspx|exe|dll|bat|cmd|bin|config|sql|env)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Explicitly ensure images are served with correct MIME types
<IfModule mod_mime.c>
    AddType image/png .png
    AddType image/jpeg .jpg .jpeg .jfif
    AddType image/webp .webp
</IfModule>
