# Published raster images may be shown; attachments and executable files stay private.
Options -Indexes -ExecCGI
Require all denied
<FilesMatch "(?i)^[A-Za-z0-9_.-]+\.(?:png|jpe?g|gif|webp|avif)$">
    Require all granted
</FilesMatch>
<FilesMatch "(?i)\.(?:php[0-9]?|phtml|phar|cgi|pl|py|sh)(?:\.|$)">
    Require all denied
</FilesMatch>
