Disable PHP execution for better WordPress security
Bulletproof Backups for Your WordPress Website
Fortify your business continuity with foolproof WordPress backups. No data loss, no downtime — just secure, seamless operation.
Certain folders in WordPress, like uploads, are writeable by default so that users can upload files (images, videos, etc) onto your site. Themes and plugins also create files in their respective cache directories while at work which isn’t possible unless these directories are writeable. However, this also opens up your site for potential attacks. Hackers can exploit these writeable directories by uploading malicious PHP code onto them and executing them remotely to wreak havoc on your site. The mailpoet hack, for example, allowed attackers to upload malicious scripts to the uploads folder that let them do anything with your site.
We cant do away with the write permissions that prevents uploads to these directories. But what we can do is to reduce the scope of the attacks by removing execute permissions on them. One of the simplest ways to disable PHP execution in certain folders is by adding the following lines to the htaccess file –
Deny from all
The 1st line ensures that any filename having php in it is caught. So even if the hacker uses something like hackerPHPFileDisguisedAsAJPGFile.php.jpg, it will still be prevented from execution.
For maximum security, create an htaccess file with the four lines of code specified above in the following folders in your WordPress installation:
- cache folders within themes and plugins
Even if an attacker gets his PHP code into these directories, he will definitely not be able to execute it.
You may also like
WordPress is developed with the scripting language PHP and uses either MySQL or MariaDB as its open-source relational database management system. Behind the scenes, the WordPress database stores content such…
On WordPress websites, you can easily reset your user password in the admin area or using the “Lost your password?” link displayed on the WordPress login form. Unfortunately, there is…
Are you facing issues with your current hosting and want to move to a new web hosting? Does the process of moving your website to a new host look too…
How do you update and backup your website?
Creating Backup and Updating website can be time consuming and error-prone. BlogVault will save you hours everyday while providing you complete peace of mind.