############################################
# SECURITY HARDENING FOR UPLOADS DIRECTORY
# Apache + mod_php + PHP-FPM compatible
############################################

# --------------------------------------------------
# 1. Disable PHP engine (mod_php)
# --------------------------------------------------
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

# --------------------------------------------------
# 2. Block all PHP-related files (PHP-FPM / FastCGI)
# --------------------------------------------------
<FilesMatch "\.(php|php3|php4|php5|php7|php8|phtml|phar)$">
    Require all denied
</FilesMatch>

# --------------------------------------------------
# 3. Disable CGI / script execution
# --------------------------------------------------
Options -ExecCGI

# --------------------------------------------------
# 4. Allow ONLY PDF + image files
# --------------------------------------------------
<FilesMatch "\.(pdf|jpg|jpeg|png|gif|webp|bmp|svg)$">
    Require all granted
</FilesMatch>

# --------------------------------------------------
# 5. Deny access to everything else
# --------------------------------------------------
<FilesMatch ".*">
    #Require all denied
</FilesMatch>

# --------------------------------------------------
# 6. Protect sensitive files
# --------------------------------------------------
<Files ".htaccess">
    Require all denied
</Files>

# --------------------------------------------------
# 7. Prevent MIME sniffing
# --------------------------------------------------
Header set X-Content-Type-Options "nosniff"

############################################
# END SECURITY RULES
############################################