# deny common executable/script payloads in uploads
<FilesMatch "\.(php|phtml|php[0-9]?|phar|cgi|pl|py|sh)$">
    Require all denied
</FilesMatch>
Options -ExecCGI