# Security: this folder only ever holds image files, but if an attacker
# somehow uploaded a .php file, this stops the server from executing it.
<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|cgi|asp|sh)$">
    Require all denied
</FilesMatch>
