WordPress stores uploaded files such as images and documents in folders like /wp-content/uploads/. However, if an attacker manages to upload a malicious PHP file to these folders, they could execute it and compromise your site.

To prevent this, a good security practice is to block PHP file execution in directories where it should not run, such as:

🔹 /wp-content/uploads/
🔹 /wp-includes/
🔹 /wp-content/cache/

This prevents hackers from running malicious scripts in these directories.

1️⃣ Access cPanel and open the File Manager.

2️⃣ Go to /wp-content/uploads/ and create a file named .htaccess (if it doesn’t exist). If it already exists, right-click on it and select “Edit.”

3️⃣ Add the following code and save changes:

🔹 This code blocks the execution of any PHP file in that folder.

4️⃣ Repeat this process in other directories such as /wp-includes/ and /wp-content/cache/ if needed.

1️⃣ Open the Terminal in cPanel.

2️⃣ Create the .htaccess file with the security code inside /wp-content/uploads/:

3️⃣ Verify that the file was created correctly with:

4️⃣ Repeat the process for other directories if necessary.

Disabling PHP execution in vulnerable directories is a simple yet effective way to improve WordPress security. With just a small .htaccess file, you can prevent hackers from running malicious scripts on your server.