My site loads a bunch of images from the uploads folder, using direct URLs, such as:


I'm trying to figure out a remote script execution issue, and one of the things recommended on https://wordpress.org/support/article/hardening-wordpress/ is to prevent script execution in the uploads folder, using the .htaccess file:

# Kill PHP Execution
<Files ~ "\.ph(?:p[345]?|t|tml)$">
   deny from all

My site is running on IIS, so to acheive the same result, I removed the PHP handler for the uploads folder and all it's subfolders:

<?xml version="1.0" encoding="UTF-8"?>
           <remove  name="php-7.1.7" />

However, if I use the web.config file, loading an image using a direct URL leads to a http 500 error. Consequently, themes don't load properly.

How would I go about preventing PHP script execution in the uploads folder, without breaking static file loading?

Adding <add name="StaticFile" /> below <remove name="php-7.1.7" /> makes no difference.


I don't know if that is the right way but the last time I worked with IIS, I used this code to prevent the loading of an PHP script in the uploads folder.

<?xml version="1.0" encoding="UTF-8"?>
  <location path="wp-content/uploads">
                    <add fileExtension=".php" allowed="false" />


If you try to execute a PHP script in uploads folder or in the subfolders it will result in an 404 Error.

I hope it helps you further.

Usefull Links to that subject:

Translate .htaccess Content to IIS web.config - docs.microsoft.com

My WordPress web.config - saotn.org

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.