# Matikan eksekusi PHP di folder uploads
php_flag engine off

# Blokir file PHP & sejenisnya
<FilesMatch "\.(php|phtml|php3|php4|php5|phar)$">
  Deny from all
</FilesMatch>

# Hanya izinkan tipe file gambar
<FilesMatch "\.(jpg|jpeg|png|webp)$">
  Allow from all
</FilesMatch>

# Optional: matikan directory listing
Options -Indexes