# Uploaded patient photos: images only, scripts can never run from here.
Options -Indexes -ExecCGI
<FilesMatch "\.(?i:php\d?|phtml|phar|pl|py|cgi|sh|htaccess)$">
  <IfModule mod_authz_core.c>
  Require all denied
  </IfModule>
</FilesMatch>
<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
Header set Cache-Control "private, max-age=3600"
</IfModule>
