Options -Indexes
DirectoryIndex index.html

# Clean replacement document root (2026-09-22). The original folder is kept as
# <domain>.LOCKED-INFECTED until root clears the immutable flag on it.
<FilesMatch "\.(php[0-9]?|phtml|phar|pht|phps|cgi|pl)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>