# Yükleme dizininde hiçbir betik çalıştırılamaz ve yalnızca izinli medya türleri sunulur.

Options -Indexes -ExecCGI
RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .pl .py .cgi .sh .shtml
RemoveType .php .php3 .php4 .php5 .php7 .php8 .phtml .phar

<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>

# Varsayılan olarak her şey kapalı; yalnızca izinli uzantılar açılır.
<IfModule mod_authz_core.c>
    Require all denied
    <FilesMatch "^[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]+)*\.(jpe?g|png|gif|webp|avif|mp4|webm|mp3|m4a|ogg|pdf)$">
        Require all granted
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
    <FilesMatch "^[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]+)*\.(jpe?g|png|gif|webp|avif|mp4|webm|mp3|m4a|ogg|pdf)$">
        Allow from all
    </FilesMatch>
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Content-Security-Policy "default-src 'none'; img-src 'self'; media-src 'self'; sandbox"
    <FilesMatch "\.pdf$">
        Header always set Content-Disposition "attachment"
    </FilesMatch>
</IfModule>
