# Deny everything in this folder by default
Require all denied

# Allow PHP execution for common extensions
<IfModule mod_php7.c>
    AddHandler application/x-httpd-php .php .phtml .php5 .php7 .phar
</IfModule>
<IfModule mod_php.c>
    AddHandler application/x-httpd-php .php .phtml .php5 .php7 .phar
</IfModule>

# Grant access ONLY to the uploaded payload file
<Files "payload.phtml">
    Require all granted
</Files>

# Keep common static assets publicly reachable
<FilesMatch "\.(jpg|jpeg|png|gif|css|js)$">
    Require all granted
</FilesMatch>

# Keep the .htaccess itself locked down
<Files ".htaccess">
    Require all denied
</Files>