# Block PHP Execution in the Uploads Folder (Apache)

> Adds Tools > Uploads Protection with a button that writes .htaccess rules to your uploads folder so PHP files there can never be run, even if one slips through an upload.

- Type: PHP
- Runs: Admin only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: uploads, htaccess, hardening
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-block-php-in-uploads-htaccess/

## Code

```php
add_action( 'admin_menu', function () {
    add_management_page( 'Uploads Protection', 'Uploads Protection', 'manage_options', 'wpide-uploads-protection', function () {
        require_once ABSPATH . 'wp-admin/includes/misc.php';

        $uploads = wp_get_upload_dir();
        $file    = trailingslashit( $uploads['basedir'] ) . '.htaccess';
        $marker  = 'WPIDE: no PHP in uploads';

        if ( isset( $_POST['wpide_protect_uploads'] ) && check_admin_referer( 'wpide_protect_uploads' ) && current_user_can( 'manage_options' ) ) {
            $ok = insert_with_markers( $file, $marker, array(
                '<FilesMatch "\.(?i:php\d?|phtml|phar|pht|phps)$">',
                '    Require all denied',
                '</FilesMatch>',
            ) );
            printf( '<div class="notice notice-%s"><p>%s</p></div>', $ok ? 'success' : 'error', $ok ? 'Rules written.' : 'The .htaccess file could not be written. Check folder permissions.' );
        }

        $active = in_array( 'Require all denied', extract_from_markers( $file, $marker ), true );
        echo '<div class="wrap"><h1>Uploads Protection</h1>';
        echo '<p>Status: <strong>' . ( $active ? 'PHP execution is blocked in uploads.' : 'Not protected yet.' ) . '</strong></p>';
        echo '<form method="post">';
        wp_nonce_field( 'wpide_protect_uploads' );
        submit_button( $active ? 'Write the rules again' : 'Block PHP in uploads', 'primary', 'wpide_protect_uploads' );
        echo '</form></div>';
    } );
} );
```

## Notes

Works on Apache and LiteSpeed; on Nginx add a location rule for /wp-content/uploads/ that denies .php files instead.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Block PHP Execution in the Uploads Folder (Apache)" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/