# Allow file downloads but never execute scripts
Options -ExecCGI -Indexes
<FilesMatch "\.(php|php5|phtml|pl|py|cgi|sh)$">
    Require all denied
</FilesMatch>
