# Uploaded resumes: never executed, never served over the web.
# Access denial is the primary control; the PHP directives are defence in depth.
Require all denied

<FilesMatch ".*">
  Require all denied
</FilesMatch>

# Strip any handler that could execute a file placed here.
<IfModule mod_mime.c>
  RemoveHandler .php .phtml .phar .php3 .php4 .php5 .php7 .php8 .pl .py .cgi
  RemoveType .php .phtml .phar .php3 .php4 .php5 .php7 .php8
</IfModule>

# php_flag is only valid under mod_php; guarding it prevents a 500 on PHP-FPM.
<IfModule mod_php.c>
  php_flag engine off
</IfModule>
<IfModule mod_php7.c>
  php_flag engine off
</IfModule>
<IfModule mod_php8.c>
  php_flag engine off
</IfModule>
