I have a directory on my website where I'm storing files uploaded by users. I use a whitelist for uploaded file types and also save the files with hashed names, but from what I've read another good security precaution is to stop script execution in the directory. I also want to prevent files in the directory from being directly accessed since I don't want users to be able to download files that aren't theirs.My server runs Linux with Apache. Is the following .htaccess file correct for what I'm trying to achieve?order deny,allowdeny from all<FilesMatch .php>    SetHandler None</FilesMatch>
Preventing script execution and file downloads in a directory?
security;apache httpd;php
You're looking for something like this:<Directory /path/to/dir>    Order allow, deny    Deny from all    php_admin_flag engine off</Directory>The first two directives (Order and Deny) (or 2.2 or 2.4) should prohibit anyone from accessing the directory via Apache (they will get a 403 error). The php_admin_flag turns off mod_php, which should actually be superfluous given the Deny from all.Another approach, possibly superior, is to not have the directory under your web root at all.