Case: Blocking PHP in /uploads Neutralized a Shell Upload

Case: Blocking PHP in /uploads Neutralized a Shell Upload
Forensics on a hacked site found the attacker had dropped logo.php into /wp-content/uploads/2026/03/ via a vulnerable image plugin. It was being hit as a webshell.

Execution-block SOP:

— Step 1: Deny PHP execution in uploads at nginx: location ~* /wp-content/uploads/.*\.php$ { deny all; }
— Step 2: Repeat for .phtml, .php5, .pht — attackers rotate extensions.
— Step 3: Scan uploads for existing PHP: find wp-content/uploads -name '*.ph*' — found and removed 3 files.
— Step 4: Set uploads dir to 755, files to 644.
— Step 5: Re-request the old shell URL — expect 403.

Outcome: The live webshell returned 403 immediately. Two re-upload attempts that week succeeded in writing the file but it would no longer execute. Reinfection: blocked.

Run this every time.