<b>Uploads Execution Block SOP</b>

<b>Uploads Execution Block SOP</b>
The goal: even if a malicious file lands in uploads, it can never execute.

— Step 1: Deny PHP execution in <code>wp-content/uploads</code> at the server level, not via .htaccess alone.
— Step 2: Allowlist upload MIME types; block <code>.php</code>, <code>.phtml</code>, <code>.phar</code>, <code>.svg</code> unless you sanitize SVG.
— Step 3: Verify: upload a renamed text file as <code>test.php.jpg</code> and confirm double-extension tricks don't run.
— Step 4: Strip EXIF and rewrite images on upload so polyglot files break.
— Step 5: Serve uploads from a cookieless subdomain to neuter stored-XSS reach.
— Step 6: Scan the directory weekly for any executable extension.

Do this on every site that accepts user or author uploads.
Run this every time.