Certain folders in WordPress, like uploads, are writeable by default so that users can upload files (images, videos, etc) onto your site. Themes and plugins also create files in their respective cache directories while at work which isn’t possible unless these directories are writeable. However, this also opens up your site for potential attacks. Hackers can exploit these writeable directories by uploading malicious PHP code onto them and executing them remotely to wreak havoc on your site. The mailpoet hack, for example, allowed attackers to upload malicious scripts to the uploads folder that let them do anything with your site.
We cant do away with the write permissions that prevents uploads to these directories. But what we can do is to reduce the scope of the attacks by removing execute permissions on them. One of the simplest ways to disable PHP execution in certain folders is by adding the following lines to the htaccess file –
<FilesMatch “\.(php|php\.)$”>
Order Allow,Deny
Deny from all
</FilesMatch>
The 1st line ensures that any filename having php in it is caught. So even if the hacker uses something like hackerPHPFileDisguisedAsAJPGFile.php.jpg, it will still be prevented from execution.
For maximum security, create an htaccess file with the four lines of code specified above in the following folders in your WordPress installation:
- /wp-content/uploads
- cache folders within themes and plugins
Even if an attacker gets his PHP code into these directories, he will definitely not be able to execute it.
