A single measure that prevents a class of attack.
THE ATTACK
An attacker finds a way to upload a file, uploads a PHP script disguised as an image, then requests it. The script runs, and they have a foothold.
THE DEFENCE
Prevent execution in directories that should only contain uploaded media.
Create a .htaccess file in the uploads directory containing rules denying execution of script extensions: php, phtml, phar, cgi, pl.
Even if a malicious file gets in, it cannot run.
WHERE TO APPLY IT
Any directory receiving uploads: media libraries, attachment directories, cache directories, temporary directories.
CHECKING AN EXISTING SITE
Look for PHP files in your uploads directory. Nothing legitimate puts them there.
Anything you find should be treated as a compromise and investigated rather than simply deleted.
WHY THIS IS WORTH DOING
It is a few minutes of work and it neutralises the most common outcome of an upload vulnerability.
It does not replace validating uploads properly, but it limits the damage when validation fails.
