php_flag engine off
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .phps
RemoveType .php .phtml .php3 .php4 .php5 .php7 .phps

<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|pl|py|cgi|asp|sh)$">
    Require all denied
</FilesMatch>

# SVG: paksa download, jangan render di browser (mencegah script SVG berjalan)
<FilesMatch "\.svg$">
    Header set Content-Disposition "attachment"
    Header set Content-Type "image/svg+xml"
    Header set X-Content-Type-Options "nosniff"
</FilesMatch>
