How to Disable PHP Execution in the Uploads Folder in WordPress
Tags: wordpress
Published: 2021-03-29 02:34:56

<!-- wp:paragraph -->

<p>Protecting the beloved website from evil hackers is always a matter that every website owner concerns about. Today, <a href="https://gretathemes.com/">GretaThemes</a> will introduce you to an effective way to protect your WordPress website from hacker attacks. It's disabling PHP execution in the <code>uploads</code> folder in WordPress.</p>

<!-- wp:paragraph -->

<p>Sounds a bit technical, doesn't it? However, it's actually very easy, and anyone can do it within 5 minutes. But first, let me explain why we need to disable PHP execution in the <code>uploads</code> folder in WordPress!</p>

<!-- /wp:paragraph -->

<!-- wp:heading -->

<h2>Why We Need to Disable PHP Execution in the uploads Folder</h2>

<!-- /wp:embed -->

<!-- wp:paragraph -->

<p>Normally, admin and <a href="https://gretathemes.com/the-user-roles-in-wordpress/">authorized users</a> can upload files to the <code>uploads</code> folder. Hackers can take advantage of this to upload malicious files to the WordPress website if you don't <a href="https://gretathemes.com/configure-user-role-wordpress-using-plugin/">manage user roles</a> properly.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>Especially, if your website has forms like <a href="https://gretathemes.com/series/contact-form/">contact form</a> or post <a href="https://metabox.io/how-to-create-a-contact-form-with-mb-frontend-submission/" rel="follow">submission form</a>, hackers can take advantage of these forms to upload malicious files (such as PHP files or images containing PHP code). By default, WordPress saves these files in the <code>uploads</code> folder. If you don't disable PHP execution in this folder, hackers can run <a href="https://gretathemes.com/your-website-has-malicious-code-and-malware/">malicious code</a> to hack your WordPress website. Therefore, when you prevent all users (except admin) from executing PHP in the <code>uploads</code> folder, the uploaded files that contain malicious code <strong>won't be able to run</strong>.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>There are many ways to disable PHP execution in the <code>uploads</code><strong> </strong>folder, and the easiest way is inserting code into the <code>.htaccess</code> file.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>Below is what we need to do:</p>

<!-- /wp:paragraph -->

<!-- wp:heading -->

<h2>How to Disable PHP Execution in the Uploads Folder</h2>

<!-- /wp:heading -->

<!-- wp:paragraph -->

<p>First of all, log in to the cPanel and choose <strong>File Manager</strong>.</p>

<p><img class="aligncenter" src="https://i.imgur.com/ouU9aTJ.png" alt="Log into cPanel to disable PHP execution in the uploads folder" width="1186" height="548" /></p>

<!-- /wp:embed -->

<!-- wp:paragraph -->

<p>Afterward, look for the <code>uploads</code> folder:</p>

<p><img class="aligncenter" src="https://i.imgur.com/3hH9vr4.png" alt="Find the uploads folder" width="1052" height="617" /></p>

<!-- /wp:embed -->

<!-- wp:paragraph -->

<p>Normally, every folder in WordPress has a <code>.htaccess file</code>. To disable PHP execution in the <code>uploads</code> folder, add the following code to the <code>.htaccess</code> file in this folder:</p>

<!-- /wp:paragraph -->

<!-- wp:preformatted -->

<pre class="wp-block-preformatted">&lt;Files *.php&gt;

deny from all

&lt;/Files&gt;</pre>

<!-- /wp:preformatted -->

<!-- wp:paragraph -->

<p>In case the <code>uploads</code> folder doesn't have the <code>.htaccess</code> file, create a new one as follows:</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>On the toolbar, choose <strong>File </strong>&gt; <strong>Create New File</strong> and set the name of the new file as <code>.htaccess</code>:</p>

<p><img class="aligncenter" src="https://i.imgur.com/mgFN3vg.png" alt="Create a new .htaccess file to disable PHP execution" width="906" height="625" /></p>

<!-- /wp:embed -->

<!-- wp:paragraph -->

<p>Next, right-click the <code>.htaccess</code> file and click <strong>Edit</strong>:</p>

<p><img class="aligncenter" src="https://i.imgur.com/6RAKOjC.png" alt="Edit the .htaccess file" width="1152" height="852" /></p>

<!-- /wp:embed -->

<!-- wp:paragraph -->

<p>After that, add the above code to the <code>.htaccess</code> file and click <strong>Save changes</strong>:</p>

<p><img class="aligncenter" src="https://i.imgur.com/gUp5uZq.png" alt="Add code to the .htaccess file to disable PHP execution in the uploads folder in WordPress" width="1920" height="969" /></p>

<!-- /wp:embed -->

<!-- wp:paragraph -->

<p>Okey-dokey! We've finished disabling PHP execution in the <code>uploads</code> folder in WordPress.</p>

<!-- /wp:paragraph -->

<!-- wp:heading -->

<h2>Last Words</h2>

<!-- /wp:heading -->

<!-- wp:paragraph -->

<p>Disabling PHP execution in the <code>uploads</code> folder in WordPress is extremely fast and simple. You just need to create the file, add only three lines of code and then save it. It takes less than 2 minutes. However, this simple task can help you avoid a lot of troubles, so don't hesitate to do it right away!</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>In addition to disabling PHP execution in the <code>uploads</code> folder, you should also use <a href="https://gretathemes.com/best-wordpress-security-plugins/">security plugins</a> to protect your WordPress website better. And through time, hackers will come up with more new sophisticated tricks to hack websites. Thus, don't forget to keep up to date with the latest news on <a href="https://gretathemes.com/security/">WordPress website security</a> at GretaThemes!</p>