Uploads Directory Lockdown SOP

Uploads Directory Lockdown SOP
A webshell dropped in uploads/ is the most common reinfection vector. Make it non-executable.

— Step 1: Nginx — deny PHP under uploads: location ~* /wp-content/uploads/.*\.php$ { deny all; }
— Step 2: Apache — drop a .htaccess in uploads/ with <FilesMatch "\.ph(p|tml)$"> Require all denied </FilesMatch>
— Step 3: Block double extensions like shell.php.jpg by matching \.ph anywhere.
— Step 4: Restrict allowed MIME types on upload to images and docs you actually need.
— Step 5: Verify the bit isn't executable: find uploads/ -type f -perm -u+x returns empty.
— Verify: upload a harmless .php to uploads/ and confirm it downloads, not executes.

Run this every time.