<FilesMatch "\.php$">
  # Apache 2.4
  <IfModule mod_authz_core.c>
    Require all granted
  </IfModule>

  # Apache 2.2
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Allow from all
  </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
  <FilesMatch "\.php$">
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-UA-Compatible "IE=edge"
    Header set X-XSS-Protection "1; mode=block"
  </FilesMatch>
</IfModule>