# Static UI images only — no script execution, no directory listing.
php_flag engine off
<FilesMatch "(?i)\.(php|phtml|phtm|php[0-9]|phps|pht|phar|cgi|pl|py|sh|htaccess)$">
  Require all denied
</FilesMatch>
Options -ExecCGI -Indexes
