# Deny all script execution in uploads; serve images only.
<FilesMatch "\.(php|phtml|phar|cgi|pl|py|sh|htaccess)$">
  Require all denied
</FilesMatch>

# Only allow known image types to be served
<FilesMatch "\.(jpg|jpeg|png|webp|gif)$">
  Require all granted
</FilesMatch>

Options -Indexes