# Allow downloads but prevent PHP execution
<FilesMatch "\.(php|phtml|phar)$">
  Require all denied
</FilesMatch>
