Howto: Disable php processing in wordpress upload folder.
If you host a WordPress site and have enabled writeable permissions on any of the folders it is recommended that you disable PHP execution on these folders. If you are running Apache you can do this in the VirtualHosts file as follows:
<Directory "/path/to/my/wordpress/wp-content/uploads"> php_admin_flag engine off AllowOverride None DirectoryIndex Off RewriteEngine On RewriteRule \.php$ - [F,L] </Directory>
And here’s the test:
andrew@andrew:~$ curl -I http://www.euperia.com/wp-content/uploads/index.php HTTP/1.1 403 Forbidden Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 222 Date: Wed, 18 May 2011 09:20:59 GMT X-Varnish: 1332974452 Age: 0 Via: 1.1 varnish Connection: keep-alive
No comments yet
)