<FilesMatch "\.(php|phtml|php3|php4|php5|phar)$">
    Require all denied
</FilesMatch>

# matikan juga exec & CGI biar double-aman
Options -ExecCGI -Indexes