# Backend/uploads/installation/.htaccess
Options -Indexes
<FilesMatch "\.(php|phar|phtml|cgi|pl|sh)$">
  Deny from all
</FilesMatch>
# Optional: limit to images/PDF only via Apache, if supported
# Backend/.htaccess (optional)
php_value upload_max_filesize 10M
php_value post_max_size 12M

# If you need to tighten CORS later, remove the wildcard in PHP and use this:
<IfModule mod_headers.c>
  Header set Access-Control-Allow-Origin "*"
  Header set Access-Control-Allow-Methods "POST, OPTIONS"
  Header set Access-Control-Allow-Headers "Content-Type"
</IfModule>
