# Block PHP execution in uploads folder (security)
# Only block PHP files - images/docs serve normally

<FilesMatch "\.(php[0-9]?|phtml|phar|php\.)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Allow images and documents explicitly
<FilesMatch "\.(jpg|jpeg|png|gif|webp|pdf|doc|docx|xls|xlsx|csv|txt|jfif)$">
    Order allow,deny
    Allow from all
</FilesMatch>
