# Prevent any uploaded file from being executed as a script, no matter what
# extension it was given. This is a critical security control for a
# publicly-writable upload directory.
<FilesMatch "\.(php|php3|php4|php5|php7|phtml|pl|py|jsp|asp|sh|cgi)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Also disable script execution outright as a second layer of defense
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

Options -ExecCGI -Indexes
AddType text/plain .php .php3 .php4 .php5 .phtml
