Where attacks get in.
THE RISK
A form accepting files, exploited to upload something executable.
WHAT TO RESTRICT
Which file types are accepted Maximum size Whether uploaded files can be executed
CHECKING THE ACTUAL TYPE
Extension checking is insufficient.
A file named as an image may not be one.
PREVENTING EXECUTION
A rule preventing scripts running in your upload directory closes this route.
Many security plugins add it. Any developer can.
WHERE UPLOADS ARE STORED
If in public_html, anyone with the address can download them.
For personal documents, that matters.
THE CV AND DOCUMENT CASE
Job applications and quote requests contain personal data.
Those should not be publicly downloadable.
WHAT TO CHECK
Whether your upload directory can be browsed Whether PHP executes there
IF YOU FIND UNEXPECTED FILES IN UPLOADS
Particularly script files. That is a strong indication of compromise.
Investigate immediately.
