Block PHP in wp-includes, wp-content & uploads

Code for /wp-content/.htaccess

<FilesMatch "\.(?i:php)$">
 <IfModule !mod_authz_core.c>
 Order allow,deny
 Deny from all
 </IfModule>
 <IfModule mod_authz_core.c>
 Require all denied
 </IfModule>
</FilesMatch>

Code for /wp-includes/.htaccess

<FilesMatch "\.(?i:php)$">
 <IfModule !mod_authz_core.c>
 Order allow,deny
 Deny from all
 </IfModule>
 <IfModule mod_authz_core.c>
 Require all denied
 </IfModule>
</FilesMatch>

<Files wp-tinymce.php>
 <IfModule !mod_authz_core.c>
 Allow from all
 </IfModule>
 <IfModule mod_authz_core.c>
 Require all granted
 </IfModule>
</Files>

<Files ms-files.php>
 <IfModule !mod_authz_core.c>
 Allow from all
 </IfModule>
 <IfModule mod_authz_core.c>
 Require all granted
 </IfModule>
</Files>

Code for /wp-content/uploads/.htaccess

<FilesMatch "\.(?i:php)$">
 <IfModule !mod_authz_core.c>
 Order allow,deny
 Deny from all
 </IfModule>
 <IfModule mod_authz_core.c>
 Require all denied
 </IfModule>
</FilesMatch>

Leave a Reply

Your email address will not be published.