# Uploaded images only. Nothing here can run as code.
# Only .jpg / .jpeg / .png / .webp files can be requested; everything else is refused.
<IfModule mod_authz_core.c>
    Require all denied
    <FilesMatch "\.(?i:jpe?g|png|webp)$">
        Require all granted
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
    <FilesMatch "\.(?i:jpe?g|png|webp)$">
        Allow from all
    </FilesMatch>
</IfModule>

# Never let the browser guess a different content type.
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set Content-Security-Policy "default-src 'none'; img-src 'self'; style-src 'none'; script-src 'none'"
</IfModule>
