WordPress Security Tips Part 9 – Prevent PHP files from executing

Since WordPress sites need to allow their users to upload new content, WordPress’ upload directory needs to be writable. To such an extent, your wp-contnet/uploads directory should be considered a potential entry point.

The biggest potential threat is the uploading of PHP files. WordPress won’t allow users to upload PHP files within its administrative console, however, it may be the case that a plugin or theme allows file uploads without using the designated WordPress APIs for doing so. This could result in a malicious PHP file being uploaded and consequently executed on the server.

The best approach to mitigate this potential security risk is to deny the web server from serving any PHP files in the wp-content/uploads directory using the following rule.

<Directory "/var/www/wp-content/uploads/">

<Files "*.php">

Order Deny,Allow

Deny from All

</Files>

</Directory>

10th and final article in the series on WordPress Security: Secure your Debug Logs

Read the entire article on How to prevent a WordPress hack

THE AUTHOR

Ian Muscat

Ian Muscat used to be a technical resource and speaker for Acunetix. More recently, his work centers around cloud security and phishing simulation.