Options -Indexes -ExecCGI

# Defense in depth: folder ini hanya untuk asset gambar raster.
# Script / markup aktif diblokir walaupun suatu saat file aneh berhasil masuk.
<FilesMatch "\.(php[0-9]?|phtml|pht|phar|cgi|fcgi|pl|py|rb|sh|bash|shtml|html?|js|mjs|svg|xml|htaccess|ini|env)$">
    Require all denied
</FilesMatch>

<IfModule mod_mime.c>
    RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .pht .phar .cgi .fcgi .pl .py .rb .sh
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
</IfModule>
