Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

Most of my sites seem to be continually hacked, no matter how many times I scan and clean the files.  Typically it is the uploading of PHP and ICO files along with code injection to existing files.  In an effort to block the injection I am looking at setting custom permissions and wanted some feed back as your thoughts…

All *.php files set to 544 to avoid writing permission or prevent injection.
Folders set to 555 and,”wp-upload” to 755.

The wp-config file would need to be 755 else plugins such as GOTMLS would not be able to write in the brute force code to it.

I have also been working on a custom htaccess file for the uploads folder.  GOTMLS flags it as a threat for some reason…

# Only allow the following direct access to the uploads directory
RewriteCond %{REMOTE_ADDR} !^(?:xxx\.xxx\.xxx\.xxx)
RewriteCond %{HTTP_HOST} !^localhost$ [NC]
RewriteCond %{HTTP_REFERER} !^https?://(?:[^.]+\.)?example\.com/ [NC]
RewriteRule .? http://example.com [L]

# Disable hotlinking of images
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} \.(?:jpe?g|png|gif)$ [NC]
RewriteCond %{HTTP_REFERER} !^(?:https?://(?:[^.]+\.)?example\.com/|$) [NC]
RewriteRule \.(?:jpe?g|png|gif)$ – [NC,F]

# Only allow GET and POST request methods

Deny from all

For those that do not know what each line does, I’ve broken it down here. By first listing the rule, then following up with a description of what it does:

# Disable any cgi-scripts and prevent directory browsing
Options -ExecCGI -Indexes
This is first to disable any cgi-scripts, it is connected with another rule below. Then it prevents directory listing, viewing, etc.

# Whitelist the following file extensions
# This includes the blocking of double extensions using [^.]
Order Allow,Deny

Allow from all

This is the whitelisting of certain file extensions. This is case insensitivity and blocks any double extensions, like something.php.jpg or similar. You must note that if users upload legitimate file extensions with a literal period in the filename, it will also be blocked. This is why it’s always a good idea to incorporate some type of file renaming utility when they upload files.

# Secure MIME-types

ForceType image/jpeg

ForceType image/png

ForceType image/gif