diff --git a/root/defaults/nginx/site-confs/default.conf.sample b/root/defaults/nginx/site-confs/default.conf.sample
index be9b43f..6389dc9 100644
--- a/root/defaults/nginx/site-confs/default.conf.sample
+++ b/root/defaults/nginx/site-confs/default.conf.sample
@@ -1,4 +1,4 @@
-## Version 2026/06/27 - Changelog: https://github.com/linuxserver/docker-grav/commits/main/root/defaults/nginx/site-confs/default.conf.sample
+## Version 2026/07/31 - Changelog: https://github.com/linuxserver/docker-grav/commits/main/root/defaults/nginx/site-confs/default.conf.sample
 
 server {
     listen 80 default_server;
@@ -31,13 +31,30 @@ server {
 
     ## Begin - Security
     # deny all direct access for these folders
-    location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
+    location ~* ^/(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
+    # deny all direct access to these sensitive user folders, whatever the file type
+    location ~* ^/user/(config|env)/.*$ { return 403; }
+    # allow avatar images under user/accounts to be served directly, whether stored
+    # at user/accounts/avatars/<file> (flatfile accounts) or user/accounts/<username>/
+    # <file> (Flex folder storage); this must come before the user/accounts deny so it
+    # wins the first-match. SVG is intentionally excluded as a stored-XSS vector.
+    location ~* ^/user/accounts/[^/]+/[^/]+\.(jpe?g|png|gif|webp|avif|bmp|ico)$ { try_files $uri =404; }
+    # deny everything else under user/accounts, whatever the file type
+    location ~* ^/user/accounts/.*$ { return 403; }
+    # allow public media uploads under user/data (e.g. Flex Object images) to be
+    # served directly; this must come before the user/data deny so it wins the
+    # first-match. SVG is intentionally excluded as a stored-XSS vector.
+    location ~* ^/user/data/.*\.(jpe?g|png|gif|webp|avif|bmp|ico|mp4|webm|ogg|ogv|mov|mp3|wav|m4a|flac|pdf)$ { try_files $uri =404; }
+    # deny everything else under user/data, whatever the file type
+    location ~* ^/user/data/.*$ { return 403; }
     # deny running scripts inside core system folders
-    location ~* /(system|vendor)/.*\.(txt|xml|md|html|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
+    location ~* ^/(system|vendor)/.*\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ { return 403; }
     # deny running scripts inside user folder
-    location ~* /user/.*\.(txt|md|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
+    location ~* ^/user/.*\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ { return 403; }
     # deny access to specific files in the root folder
-    location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
+    location ~ ^/(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
+    # deny access to .env environment files (expression purposefully not anchored)
+    location ~ /\.env(\.|$) { return 403; }
     ## End - Security
 
     ## https://learn.getgrav.org/17/webservers-hosting/servers/nginx#nginx-cache-headers-for-assets