# Allow image and document files to be served directly
# Block everything else (PHP, etc.)
<FilesMatch "\.(php|php3|php4|php5|phtml|pl|py|cgi|sh)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Allow image and document types
<FilesMatch "\.(jpg|jpeg|png|gif|webp|pdf|svg)$">
    Order Allow,Deny
    Allow from all
</FilesMatch>

Options -Indexes