PHP-in-uploads protection watch

Blocking PHP in upload folders stops most dropped webshells from running, and it is easy to undo by accident. The PHP-in-uploads protection watch (Pro) checks that the rule is still there and still works.

What it checks

• The managed block in your .htaccess is still present and unedited.
• Each folder is verified on its own: media, images, uploads, tmp, cache and files. A folder that stops refusing PHP is named.

What you see

A red row, PHP-in-uploads protection has stopped working, appears on the Dashboard with the time it was noticed and a Re-apply the rule button. You also get an e-mail from the scheduled check, unless you switch that alert off under Alert rules.

Nginx

Nginx has no .htaccess. The row tells you to add the Nginx rule from the .htaccess Hardening advisor to your server configuration instead.