# Allow media file viewing while strictly preventing script execution on both mod_php and PHP-FPM / FastCGI (StackCP)
Options -ExecCGI -Indexes

<IfModule mod_authz_core.c>
    Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Allow from all
</IfModule>

# For FastCGI / PHP-FPM (20i StackCP / cPanel / Plesk): Force static default handler and strip script handlers
<IfModule mod_mime.c>
    RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phps .phar .cgi .pl .exe .sh .py .rb .asp .aspx
    RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8 .phps .phar .cgi .pl .exe .sh .py .rb .asp .aspx
</IfModule>
SetHandler default-handler

# For legacy mod_php (Apache DSO module): Disable PHP engine if module is loaded
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

# Strictly deny web requests to executable and script file types (case-insensitive)
<FilesMatch "(?i:\.(php[0-9]?|phtml|phtm|phar|phps|cgi|pl|exe|sh|py|rb|asp|aspx|shtml|inc|hphp))$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</FilesMatch>
