# Prevent any file from being treated as PHP, even if misconfigured
RemoveHandler .php .phtml .php3 .php4 .php5 .html .htm
RemoveType .php .phtml .php3 .php4 .php5 .html .htm

# Block execution of PHP and sensitive files
<FilesMatch "\.(php|inc|env|ini|bak|sql)$">
    Require all denied
</FilesMatch>