title: Unexpected "php_flag not allowed here" messages
body: <p>I'm running a webserver on my home PC as a development version of a WordPress  site which I maintain on the internet. I'm running WordPress 4.8.3, php 7.1 and apache 2.4 on a FreeBSD 11.1 system. Everything has been running fine for many months until yesterday afternoon when it suddenly stopped displaying images.</p>
  
  <p>The apache error log showed "wp-content/uploads/.htaccess: php_flag not allowed here" messages.</p>
  
  <p>Here's the relevant.htaccess file.</p>
  
  <pre><code># BEGIN Wordfence code execution protection
  &lt;IfModule mod_php5.c&gt;
  php_flag engine 0
  &lt;/IfModule&gt;
  &lt;IfModule mod_php7.c&gt;
  php_flag engine 0
  &lt;/IfModule&gt;
  
  AddHandler cgi-script .php .phtml .php3 .pl .py .jsp .asp .htm .shtml .sh .cgi
  Options -ExecCGI
  # END Wordfence code execution protection
  </code></pre>
  
  <p>The file was created by the WordFence security plugin to prevent code execution in the uploads directory (which is where our images are stored), it has been present for many months without causing any problem. The same file exists on our internet site which has the same versions of WordPress, php and apache on a Centos system and I'm not having any problems there (yet).</p>
  
  <p>As a workaround I've deleted the .htaccess file and everything is now working correctly. Since the site isn't accessible from outside my home network this deletion doesn't present any significant security risk but I'm hoping to be able to track down and fix the cause of the problem in case it's likely fo occur on the production site.</p>
  
  <p>I'm not aware of any changes which would be likely to cause this sudden change in behaviour. I was logged in as a normal user at the time making some changes to one of our plugins. That plugin would not have been able to alter any apache configuration settings although I did restore the plugin to its earlier state but that didn't have any effect.</p>
  
  <p>In an attempt to track down the cause of the problem I've done the following:</p>
  
  <ul>
  <li>checked that the apache configuration files hadn't been changed</li>
  <li>restored the entire website code from the previous day's backup</li>
  <li>restored the MySQL database from the previous day's backup</li>
  <li>restored the entire operating system from the previous day's backup</li>
  </ul>
  
  <p>None of these produced any solution to the problem.</p>
  
  <p>What other factors might cause this sudden rejection of the php_flag directive?</p>