Disable PHP execution

.htaccess

# Turn off all options we don't need.
Options None
Options +FollowSymLinks
# Set the catch-all handler to prevent scripts from being executed.
SetHandler Security_Do_Not_Remove_This_Line
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Security_Do_Not_Remove_This_Line
</Files>
# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

example.com.conf

location ^~ /storage/ {
    access_log off;
    expires 30d;
    add_header Pragma public;
    add_header Cache-Control "public";
    
     # Prevent php files from being accessible in this location
    location ~ \.php$ {
        return 403;
    }
}