# Serve uploaded files as static; no PHP execution here.
<FilesMatch "\.php$">
  Require all denied
</FilesMatch>
