Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBlock PHP execution in wp-content/uploads using a control supported by your host, but do not apply a blanket rule to wp-includes without checking compatibility. Some managed WordPress tools offer a restriction for wp-includes, while an Apache Toolkit example makes a specific TinyMCE exception. There is no single safe rule for every hosting stack.
Why block PHP execution in uploads?
The wp-content/uploads directory is intended for uploaded media, which normally has no reason to run as PHP. Preventing PHP files there from executing can reduce the risk that an uploaded executable file is invoked directly. Softaculous documents a security option that prevents PHP execution in this directory: Softaculous WordPress Manager Security Measures.
Use your hosting control panel’s supported security setting if one is available. A manual .htaccess rule is appropriate only when the server is configured to read that file and permits the directives it contains.
Should you also restrict PHP in wp-includes?
Not with an unreviewed, blanket rule. The answer in the original SitePoint discussion says WordPress relies on PHP scripts in wp-includes and advises against disabling PHP there. That is one forum participant’s advice, not a universal platform guarantee.
#1 Best Overall
On the other hand, Softaculous documents a managed option that prevents PHP execution in wp-includes. A WordPress Toolkit hardening guide also gives an Apache-oriented example that blocks PHP requests in the directory while making an exception for wp-includes/js/tinymce/wp-tinymce.php. That example illustrates why rules may need exceptions; it does not establish that this exact exception is needed on every current WordPress site.
So, a carefully managed restriction may work in a particular environment, but the availability of a control or example does not make a custom blanket denial safe everywhere. Prefer the implementation your host supports and verify the site’s behavior afterward.
Choose a control that matches your hosting stack
| Approach | What to check | Trade-off |
|---|---|---|
| Hosting or WordPress Toolkit security option | Confirm which directory it affects, whether it adds exceptions, and how to reverse it. Softaculous documents options for both directories and says its security measures can be reverted if they make the site work incorrectly. | Uses a provider-managed control, but the setting’s exact behavior depends on the tool and configuration. |
Manual .htaccess rule |
Confirm the server is Apache-based, reads .htaccess for that directory, and allows the directives used. Review the rule’s scope and any needed exceptions. |
Offers direct control, but may be ignored or rejected by the server, or block files the site needs. |
| Nginx or another server configuration | Ask the hosting provider or administrator for the supported server-native method. | The cited Apache example does not provide universal instructions for Nginx or other stacks. |
Server configuration determines whether .htaccess is honored and how PHP requests are routed. The available examples do not establish a one-size-fits-all directive for Apache, Nginx, PHP-FPM, or managed hosting. If you use a manual rule, follow documentation for your actual stack rather than copying an isolated snippet.
Apply the restriction and check for breakage
- Identify the server and control available. Check your hosting documentation or ask support whether the site uses Apache, Nginx, or another stack, and whether a managed WordPress security option is provided.
- Apply the narrowest supported setting. For uploads, restrict PHP execution in
wp-content/uploads. Forwp-includes, use only a host-supported or administrator-reviewed configuration, including any exceptions it requires. - Test the public site and administration area. Open representative front-end pages and sign in to
wp-admin. Check the features and pages your site actually uses for errors or missing functionality. - Undo the specific change if behavior breaks. Use the control panel’s reversal option when available, or have the administrator remove or revise the rule. Softaculous says its security measures can be reverted if they make a site work incorrectly.
Toolkit settings are not interchangeable: cPanel separately documents that disabling admin script concatenation can cause Site Health inconsistencies. That is a different setting, not evidence that PHP restrictions in either directory cause the same issue. See cPanel’s explanation.
Recommended Free Tools
What the available evidence does—and does not—establish
Softaculous’s documentation, last modified May 14, 2026, describes managed PHP restrictions for both directories and says custom .htaccess directives may override its measures. The Toolkit example is Apache-oriented, and the SitePoint and Plesk discussions are forum reports rather than universal compatibility documentation. A Plesk forum discussion describes an individual Ubuntu 24.04/Plesk Obsidian 18.0.65 setup and suggests WP Toolkit; it does not prove the right configuration for other installations.
These sources support using a managed restriction where available, especially for uploads, and treating wp-includes as an environment-specific decision. They do not show that every PHP file in wp-includes can be denied safely, or that any single custom rule works across hosts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
