Options -Indexes
<FilesMatch "\.(mp4|webm|mov|mkv|jpg|jpeg|png|webp)$">
  Header set Content-Disposition inline
  Header set Cache-Control "public, max-age=31536000, immutable"
</FilesMatch>
# Block PHP execution in the uploads dir as belt-and-braces
<FilesMatch "\.(php|phtml|phar)$">
  Require all denied
</FilesMatch>
# Internal sidecar markers — not for the web.
<FilesMatch "\.unlisted$">
  Require all denied
</FilesMatch>