<?xml version="1.0" encoding="UTF-8"?>
<!-- FluentForm: IIS counterpart of the .htaccess guard. It stops server-side scripts from being
     executed out of the upload directory while leaving normal static downloads working. Uses
     Request Filtering (installed by default on IIS 7+) rather than a URL-authorization deny-all,
     which needs the URL Authorization role and 500s the whole tree when that role is absent. -->
<configuration>
    <system.webServer>
        <security>
            <requestFiltering>
                <fileExtensions allowUnlisted="true">
                    <add fileExtension=".php" allowed="false" />
                    <add fileExtension=".php3" allowed="false" />
                    <add fileExtension=".php4" allowed="false" />
                    <add fileExtension=".php5" allowed="false" />
                    <add fileExtension=".php7" allowed="false" />
                    <add fileExtension=".php8" allowed="false" />
                    <add fileExtension=".phtml" allowed="false" />
                    <add fileExtension=".phar" allowed="false" />
                    <add fileExtension=".asp" allowed="false" />
                    <add fileExtension=".aspx" allowed="false" />
                    <add fileExtension=".ashx" allowed="false" />
                    <add fileExtension=".asmx" allowed="false" />
                    <add fileExtension=".cgi" allowed="false" />
                    <add fileExtension=".pl" allowed="false" />
                    <add fileExtension=".py" allowed="false" />
                    <add fileExtension=".exe" allowed="false" />
                    <add fileExtension=".dll" allowed="false" />
                    <add fileExtension=".config" allowed="false" />
                </fileExtensions>
            </requestFiltering>
        </security>
    </system.webServer>
</configuration>