Options -Indexes
# Uploaded thumbnails are image-only. Never execute PHP/CGI/scripts here.
<FilesMatch "\.(php|php[0-9]*|phtml|phar|cgi|pl|py|sh|shtml|asp|aspx|jsp|js|html?)$">
  Require all denied
</FilesMatch>
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
</IfModule>
