<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <security>
      <requestFiltering>
        <hiddenSegments>
          <add segment="attachments" />
        </hiddenSegments>
        <fileExtensions allowUnlisted="true">
          <add fileExtension=".php" allowed="false" />
          <add fileExtension=".phtml" allowed="false" />
          <add fileExtension=".php3" allowed="false" />
          <add fileExtension=".php4" allowed="false" />
          <add fileExtension=".php5" allowed="false" />
          <add fileExtension=".php7" allowed="false" />
          <add fileExtension=".phar" allowed="false" />
          <add fileExtension=".phps" allowed="false" />
          <add fileExtension=".pht" allowed="false" />
          <add fileExtension=".phpt" allowed="false" />
          <add fileExtension=".inc" allowed="false" />
        </fileExtensions>
      </requestFiltering>
    </security>
    <handlers>
      <!-- Explicitly remove PHP handler for this directory -->
      <remove name="PHP_via_FastCGI" />
      <remove name="php-7.4.33" />
      <remove name="php" />
    </handlers>
  </system.webServer>
</configuration>