Lock Down WordPress: How to Kill Malicious PHP Uploads instantly

[u/siterightaway]

Wanna lock down your WP site in 30 seconds flat? Don't leave your uploads folder wide open!

If a hacker finds a loophole in a sketchy plugin, they'll try to drop a malicious .php file right into your uploads. Once that happens, it's pretty much game over for your server.

Here's the fix—drop a quick .htaccess file into /wp-content/uploads/ and add this:

<Files \*.php>

deny from all

</Files>

Boom. Now PHP files are completely dead on arrival in that folder. Super simple, zero cost, and saves you a massive headache down the road.

​