Preventing a hacker from uploading a file / prevent from executing

[eruna]

I just found a few malicious files in the upload folders on my site. Is there a way to limit what types of files can be uploaded with htaccess or at least prevent php files from executing in certain directories?

[wonshikee]

Yes

If you had a folder /upload, you would put it at /upload/.htaccess,

Put:

SetHandler Disable_All_File_Execution

within the file.

Note: Disable_All_File_Execution means nothing, you're basically setting "SetHandler" directive to an invalid handler, so that files aren't executed.

The next step after this, is to prevent users from uploading malicious files in the first place.