How can I disable PHP execution in a specific subdirectory?

[binaryfire]

Hi guys

How can I disable PHP in a specific subdirectory? I've got a media uploads folder where I want to prevent PHP execution (for an added layer of security).

Thanks!

 

[Cold-Egg]

Can use rewrite rule to prevent it. Go to the uploads folder and add .htaccess with following rules,

RewriteEngine on
RewriteRule (.*)php$ - [F]

 

[robyflc]

Hi, guys!

I have tried the rewrite rule above but I've just found out that it only works if the file name is explicitly written.
If I have such .htaccess file inside a folder named /uploads, it would prevent someone trying to access

//example.com/uploads/index.php

but they would still be able to access
//example.com/uploads/

and it would show them the index.php file.

I believe the only way to prevent this would be to completely disable the PHP file execution inside de folder but I didn't find a way to do it.
Is there a way to disable PHP execution inside specific directories?

 

[Cold-Egg]

How about creating a "/uploads/ " context from web admin and set no to Accessible option.

 

[robyflc]

I'll try it and leave a comment to say if it worked. Thanks a lot!

 

[robyflc]

How about creating a "/uploads/ " context from web admin and set no to Accessible option.

I've tried to create a context and got the same result: if I use /wp-contents/uploads/ as the context, file uploads stop working.
If I use /wp-contents/uploads/*.php, file uploads work fine, I cannot access /wp-contents/uploads/index.php but /wp-contents/uploads/ still show me index.php.

 

[Cold-Egg]

Hi,

This works for me, no extra .htaccess needed.

 

[robyflc]

I

Hi,

This works for me, no extra .htaccess needed.
View attachment 661

I did it and images stopped working:

 

[gilles]

@Cold-Egg: I think @robyflc is trying to block directory listing and php execution.

 

[Cold-Egg]

Hi @robyflc, I see, please ignore the context method.

Please try putting this on the document root .htaccess file

RewriteRule ^wp-content\/uploads(\/|.*\/|php)$ - [F,L]

or put the following on the /wp-content/uploads/.htaccess file.

RewriteCond %{REQUEST_URI} ^.*(\/|php)$ [NC]
RewriteRule .* - [F,L]

Let us know which one works for you.

 

[bumkailashkumar]

this worked
RewriteCond %{REQUEST_URI} ^.*(\/|php)$ [NC]
RewriteRule .* - [F,L]

Thanks

 

[Cold-Egg]

Happy to help.