Securely uploading files to a server?

Question

Information Security

Clients upload pictures, videos and other files to my server, without restrictions.
How can I secure such a download?
The first thing that comes to mind is to upload a file from the site to a folder of another subdomain, for example files.example.com, in which php and other programming languages ​​will be disabled.
And upload files to the main site example.com through this subdomain.
How secure will it be for me, XSS they can no longer do? How else can they harm the main site?

Answer 1

Here is a good article: https://habr.com/ru/post/44610/

Answer 2

Load always ABOVE the www web-root folder to avoid calling the handler from the web.
Folder hierarchy example:

upload
www //web-root