<Files ~ "^.*\.([Pp][Hh][Pp])"> #PHP protection
    Order Deny,Allow
    Deny from all
</Files>

# Instagram Graph API fetcher can fail on byte-range (206) responses on some servers/CDNs.
# Disable Range requests for this directory so media URLs return a simple 200 OK response.
<IfModule mod_headers.c>
    RequestHeader unset Range
    Header unset Accept-Ranges
    Header always set X-Content-Type-Options "nosniff"
</IfModule>