File Security Overview

The Files, Malware & Integrity section is a focused hardening area for external assets and the uploads directory, not a general malware scanner.

Purpose of the section

This section exists to reduce common file‑based attack paths in WordPress by:

• Enforcing Subresource Integrity (SRI) for external scripts and styles so browsers can verify those assets have not been modified in transit or on a CDN.
• Blocking PHP execution in wp-content/uploads so uploaded webshells or malicious scripts are much harder to execute.
• Providing an nginx include snippet that applies the same “no PHP in uploads” rule on nginx deployments.

It is oriented around prevention and integrity rather than signature-based malware detection.

Available components

The page is organized into three main cards, all saved together with a single Save Settings action:

• Subresource Integrity – Compute hashes for external assets
  • Toggle to automatically compute SRI and crossorigin attributes for enqueued external scripts and styles loaded over HTTPS from non‑local hosts.
  • A UA-variant hosts (per-user-agent SRI hashes) textarea where you list hosts (one per line or comma-separated) that serve different asset variants per user agent (for example, Google Fonts). For those hosts, the system keeps per‑UA hashes to avoid cache bloat from mismatched content.
• Uploads protection – Block PHP execution inside uploads
  • A control that writes an .htaccess snippet into wp-content/uploads on Apache sites to deny PHP execution in that directory.
  • Intended for environments where uploads is writable and should hold media and documents only, not executable code.
• Nginx deployment – Generate nginx uploads snippet
  • A control that generates an nginx config include file (for example, wp-content/uploads/cmsspm-nginx-uploads.conf) which you can reference from your nginx server block.
  • The snippet is designed to deny PHP execution in wp-content/uploads, mirroring the Apache .htaccess behavior for nginx-based deployments.

Taken together, these components let administrators strengthen file handling and external asset integrity from one place, choosing the server‑specific options (Apache .htaccess vs nginx include) that match their environment.