Skip to main content
How Can We Help?
< All Topics
Print

Block PHP execution in uploads

Posted
Updated
Byadmin

WARNING: This control affects how the web server handles files inside wp-content/uploads. Before enabling it, confirm whether the site is running on Apache or nginx and verify that no legitimate workflow depends on executing PHP from the uploads directory.

WARNING: For Apache deployments, the control writes an .htaccess rule and depends on Apache honoring .htaccess files. For nginx deployments, the generated snippet does not take effect until it is added to the server block and nginx is reloaded, so deployment steps should be tested carefully before applying them in production.

Description of the control

Use this grouped control to prevent PHP execution inside wp-content/uploads. The interface provides two server-specific methods for the same goal: an Apache .htaccess rule through Block PHP execution inside uploads, and an nginx include file through Generate nginx uploads snippet.

This control is intended to reduce the risk of uploaded PHP files being executed if an unexpected file reaches the uploads directory. Administrators should use the method that matches the site’s web server platform.

Procedure

  1. Open Posture Management.
  2. Select Files, Malware & Integrity.
  3. Decide which method applies to the server running the site.
  4. For Apache-based sites, in Block PHP execution inside uploads under Uploads protection, enable Write an .htaccess snippet inside wp-content/uploads to deny PHP execution.
  5. Confirm that the uploads directory is writable and that Apache is configured to honor .htaccess files.
  6. For nginx-based sites, in Generate nginx uploads snippet under Nginx deployment, enable Generate an include file you can add to your nginx server block to deny PHP in wp-content/uploads.
  7. Review the help text for the nginx method and note the example include path: include wp-content/uploads/cmsspm-nginx-uploads.conf;.
  8. Select Save Settings.
  9. If you enabled the nginx method, update the nginx server block to include the generated file and reload nginx after validating the configuration.

Validation

For Apache deployments, confirm that the expected .htaccess rule or file has been written inside wp-content/uploads. In a safe test environment, verify that a PHP file in the uploads directory is not executed.

For nginx deployments, confirm that the generated uploads snippet file exists at the expected path and is included by the nginx server block. After reloading nginx, verify in a safe test environment that PHP files inside wp-content/uploads are blocked from executing.

Table of Contents