SeenSecure Help
EspañolEnglishDeutschFrançais

Upload Protection

Blocks malicious files before they reach the server: dangerous extensions, invalid MIME types, double extension, null byte injection, and content scanning.

📤 Upload Protection Overview

The Uploads tab protects your WordPress against one of the most critical attack vectors: malicious file uploads. An attacker who manages to upload a PHP file can execute arbitrary code, install backdoors, steal data, or take full control of the site.

🚨 What attack types are prevented? Remote PHP execution, persistent backdoors, data theft (wp-config, users), server abuse (cryptomining, spam), site defacement, and privilege escalation.

🎯 What it blocks

  • PHP .php, .phtml, .php5, .php7, .pht files
  • EXECUTABLES .exe, .bat, .cmd, .sh, .bin, .msi
  • SCRIPTS .js, .vbs, .jsp, .asp, .aspx, .shtml
  • DOUBLE EXT. image.jpg.php, file.pdf.exe
  • NULL BYTE file.php%00.jpg
  • SIZE Files exceeding the configured limit

🔍 Real attack examples

# Subir un shell PHP para tomar el control shell.php → acceso remoto al servidor
# Ocultar PHP en una imagen subida al avatar avatar.php (con cabecera GIF) → backdoor persistente
# Doble extensión para engañar a WordPress imagen.jpg.php → se ejecuta como PHP
# Null byte injection para truncar la extensión shell.php%00.jpg → el servidor ignora .jpg

📋 Blocked Extensions & MIME Types

The firewall maintains a list of over 30 dangerous extensions blocked by default. It's a free-text, comma-separated field: you can add or remove extensions based on your site needs. You can also configure maximum file size limits and customize the blocked MIME type list.

Category Default Blocked Extensions
PHP .php .php3 .php4 .php5 .php7 .phtml .pht .phps .phar .pgif
EXECUTABLES .exe .bat .cmd .com .pif .scr .msi .app .deb .rpm
SCRIPTS .js .ws .wsh .vbs .ps1 .sh .shtml .cgi .pl .py .jar
💡 Customizable list: These are the extensions blocked out of the box. You can add others you want to block explicitly (e.g. .htaccess, .sql, or .svg) or remove one your site legitimately needs to upload — it's a free-text field you edit yourself.

📏 Max file size

Set the limit in MB (10MB by default). If you set 0, your WordPress/hosting's general upload limit is used instead, governed by upload_max_filesize and post_max_size in php.ini.

🚫 Blocked MIME types

Editable list of MIME types that will be automatically rejected. By default it includes: application/x-php, application/x-httpd-php, text/php, application/x-executable, text/x-php. You can add more types as needed.

💡 Customization: If your site legitimately uploads file types that are being blocked (e.g., .svg files for icons), you can remove that extension from the list. However, review the security risks first.

🔬 Advanced Protection

The three advanced options provide additional analysis layers that detect common evasion techniques attackers use to bypass extension lists.

🔍 Scan file content

Inspects the actual file content looking for malicious code signatures. Detects PHP hidden inside images (malicious GIF), embedded scripts, obfuscation, and other camouflage techniques. It does not rely only on the extension or declared MIME — it examines the actual bytes.

🔗 Detect double extension

Detects files with multiple extensions such as image.jpg.php or document.pdf.exe. Attackers use this technique because some systems only validate the last extension (fooling basic validations), but the server executes the first dangerous extension. Also detects variants like file.php;.jpg or file.php..jpg.

💉 Detect null byte injection

The attacker adds a null byte character (%00) in the filename to truncate the extension at the filesystem level. For example, shell.php%00.jpg — the system sees .jpg and allows it, but the server saves shell.php because the filesystem truncates at the null byte.

✅ Recommendation: Keep all 3 advanced options ENABLED. They are lightweight, do not affect performance, and close well-known attack vectors. Without them, an attacker can evade the extension list with simple techniques.

⭐ Recommendations & Best Practices

Follow these recommendations to maximize upload protection without affecting your site functionality.

📏 Recommended size limits

🖼️ Images

10 MB — Enough for high-res photos on portfolio sites, galleries, or WooCommerce. A legitimate image rarely exceeds this size.

🎥 Videos / PDFs

50 MB — Suitable for short videos, presentations, and large PDF documents. If you need more, consider external streaming (YouTube, Vimeo).

📦 Compressed files

25 MB — For .zip, .rar, .tar.gz files. Be wary of very large compressed files — they often contain packaged malicious content.

📋 Golden rules

  1. Keep all 3 advanced options ENABLED — Content scan, double extension, and null byte. They are your last line of defense against evasions.
  2. Don't remove extensions from the list without reason — Each blocked extension is a closed attack vector. If you need one, assess the risk and consider safer alternatives.
  3. Review the activity log periodically — The last 20 blocked upload attempts appear in the log. Reviewing them helps you identify attack patterns and adjust settings.
  4. Combine with server-level security — Upload protection works at the WordPress application level. For maximum security, combine it with web server rules (block PHP execution in wp-content/uploads via .htaccess or Nginx).

📊 Activity Log

The panel shows the last 20 blocked upload attempts, each with the following columns:

Column Description
Time Timestamp of the attempt
File Attempted filename
Reason Badge with the block reason
Action Whether the attempt was blocked (firewall in Protection/Strict mode) or only logged (Monitoring mode)
IP Source IP address of the upload
Role WordPress role of the user who attempted the upload

Reason badges can be:

Blocked extension Blocked MIME Size exceeded Double extension Null byte Malicious content
🔍 Interpret the log: If you see many blocks for blocked extension from the same IP, it is likely an automated attack. Blocks for size exceeded may be legitimate users — consider adjusting the limit. Blocks for null byte or malicious content are almost always targeted attacks.

🆚 Upload protection vs. Server-level security

It is important to understand the difference between the two layers. They are not mutually exclusive — on the contrary, they complement each other.

Aspect Upload Protection (SeenSecure) Server Security (.htaccess / Nginx)
Level WordPress application (PHP) Web server (Apache / Nginx)
What it protects Blocks malicious uploads before they are saved to the server. Analyzes extension, MIME, content, double extension, null byte. Blocks file execution in specific directories. It does not prevent the upload, but prevents files from being executed as PHP.
Advantage Smart detection: content, evasions. Configurable from the WordPress dashboard. Works even if WordPress is compromised. Does not depend on PHP.
Recommendation Use both. Upload protection blocks 99% of attacks. Server-level security is the safety net that catches the remaining 1% if something fails.
📌 Note about SVG: SVG files are on the blocked list because they can contain inline JavaScript (<script> or onload). If you need to upload SVGs for icons, you can remove them from the list, but consider sanitizing them first or using a plugin that cleans SVGs automatically.