Block PHP Execution in the Uploads Folder (Apache)

add_action( 'admin_menu', function () {
    add_management_page( 'Uploads Protection', 'Uploads Protection', 'manage_options', 'wpide-uploads-protection', function () {
        require_once ABSPATH . 'wp-admin/includes/misc.php';

        $uploads = wp_get_upload_dir();
        $file    = trailingslashit( $uploads['basedir'] ) . '.htaccess';
        $marker  = 'WPIDE: no PHP in uploads';

        if ( isset( $_POST['wpide_protect_uploads'] ) && check_admin_referer( 'wpide_protect_uploads' ) && current_user_can( 'manage_options' ) ) {
            $ok = insert_with_markers( $file, $marker, array(
                '<FilesMatch "\.(?i:php\d?|phtml|phar|pht|phps)$">',
                '    Require all denied',
                '</FilesMatch>',
            ) );
            printf( '<div class="notice notice-%s"><p>%s</p></div>', $ok ? 'success' : 'error', $ok ? 'Rules written.' : 'The .htaccess file could not be written. Check folder permissions.' );
        }

        $active = in_array( 'Require all denied', extract_from_markers( $file, $marker ), true );
        echo '<div class="wrap"><h1>Uploads Protection</h1>';
        echo '<p>Status: <strong>' . ( $active ? 'PHP execution is blocked in uploads.' : 'Not protected yet.' ) . '</strong></p>';
        echo '<form method="post">';
        wp_nonce_field( 'wpide_protect_uploads' );
        submit_button( $active ? 'Write the rules again' : 'Block PHP in uploads', 'primary', 'wpide_protect_uploads' );
        echo '</form></div>';
    } );
} );