My site loads a bunch of images from the uploads folder, using direct URLs, such as:
I'm trying to figure out a remote script execution issue, and one of the things recommended on https://wordpress.org/support/article/hardening-wordpress/ is to prevent script execution in the uploads folder, using the
# Kill PHP Execution <Files ~ "\.ph(?:p?|t|tml)$"> deny from all </Files>
My site is running on IIS, so to acheive the same result, I removed the PHP handler for the uploads folder and all it's subfolders:
<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <handlers> <remove name="php-7.1.7" /> </handlers> </system.webServer> </configuration>
However, if I use the web.config file, loading an image using a direct URL leads to a http 500 error. Consequently, themes don't load properly.
How would I go about preventing PHP script execution in the uploads folder, without breaking static file loading?
<add name="StaticFile" /> below
<remove name="php-7.1.7" /> makes no difference.