# Uploaded files (logos, student documents, prospectus PDFs) should never be
# executed as code, even if someone manages to upload a disguised .php file.
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar|pl|py|cgi|sh)$">
    Require all denied
</FilesMatch>

# Belt-and-braces for older Apache (mod_authz_host instead of mod_authz_core)
<IfModule !mod_authz_core.c>
    <FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar|pl|py|cgi|sh)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
