Categories

Disable script execution for upload directories using htaccess to further secure your website (Joomla, Wordpress, Typo3)

Donate with

82uymVXLkvVbB4c4JpTd1tYm1yj1cKPKR2wqmw3XF8YXKTmY7JrTriP4pVwp2EJYBnCFdXhLq4zfFA6ic7VAWCFX5wfQbCC

Copy Monero Donation Address

Donate with

Donate BAT now

Verified BAT publisher

Why

This setting alone won't protect you against beingt hacked but it's another step forward for securing your CMS. In case an attacker manages it to compromise your system and upload a script into the /uploads directory he won't be able to execute it and further infect your installation. You should make sure though that the protected directory (in this example it's /uploads) is the only one the web server has write permissions to.

Howto

We will simply create a .htaccess file within the directory of your choice (e.g. /uploads) and add the following content:

#disable script execution
AddHandler cgi-script .php .pl .jsp .asp .sh .cgi
Options -ExecCGI

How does it work?

The "AddHandler" command will tell the web server to interprete the given file extensions as CGI scripts (executable files). In the next line we tell the server that executing CGI scripts is prohibited. That's all 😉