# ═══════════════════════════════════════════════════════
# UPLOADS PROTECTION
# - Allow public access to images, PDFs (for WhatsApp/email sharing)
# - BLOCK all PHP execution (prevent malicious uploads from running)
# - BLOCK direct access to logs, backups, sql files
# ═══════════════════════════════════════════════════════

# ── DISABLE PHP execution in uploads (MAJOR security) ──
<FilesMatch "\.(php|php3|php4|php5|phtml|pl|cgi|sh|asp|aspx|exe|bat)$">
    <RequireAll>
        Require all denied
    </RequireAll>
    Order deny,allow
    Deny from all
</FilesMatch>

# ── BLOCK sensitive files ──
<FilesMatch "\.(log|sql|sql\.gz|gz|bak|backup|env|conf|cfg|ini|htaccess|htpasswd)$">
    <RequireAll>
        Require all denied
    </RequireAll>
    Order deny,allow
    Deny from all
</FilesMatch>

# ── Block .ht* files ──
<FilesMatch "^\.ht">
    <RequireAll>
        Require all denied
    </RequireAll>
    Order deny,allow
    Deny from all
</FilesMatch>

# ── Disable PHP via handler (extra layer) ──
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>
RemoveHandler .php .phtml .php3 .php4 .php5
RemoveType .php .phtml .php3 .php4 .php5

# ── Disable directory listing ──
Options -Indexes -ExecCGI -FollowSymLinks
