# Strict security rules for /images/ and all subfolders
Options -Indexes
RewriteEngine On

# Block any dangerous executable or rogue web files anywhere under /images/
RewriteRule \.(php|phtml|php5|php7|php8|phar|cgi|pl|py|sh|bash|asp|aspx|jsp|html|htm|shtml)$ - [F,L,NC]

# For real files, allow only safe static asset extensions.
# This applies to /images/ and all subfolders.
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_URI} !\.(jpg|jpeg|png|gif|webp|svg|ico|css|js|pdf)$ [NC]
RewriteRule ^ - [F,L]