# SECURITY: uploads/ only ever holds member photos, ID scans, salary slips,
# standing orders, etc. It must never execute code, even if a malicious file
# with a spoofed extension somehow ends up here.
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

# Belt-and-braces for common script handlers regardless of PHP module version
<FilesMatch "\.(php|php\d?|phtml|pl|py|jsp|asp|aspx|sh|cgi|exe)$">
    Require all denied
</FilesMatch>
