Server Configuration
WordPress Uploads Folder Protection Check (.htaccess, index.html files)
The uploads folder must contain protection files (.htaccess, index.html) to block direct access to uploaded files. Learn how to check their presence and add them to enhance security.
What this test checks
This test checks for the presence of protection files (like .htaccess and index.html) in the WordPress upload folder (wp-content/uploads/). A .htaccess file with 'Deny from all' blocks direct access to files, while an empty index.html prevents content listing. Lack of these protections exposes your files to public access.
Our recommendation
Ensure the wp-content/uploads/ folder contains a .htaccess file with the directive 'Deny from all' or 'Options -Indexes'. Also add an empty index.html (or index.php) file to hide folder content. If you use a security plugin, enable automatic protection for sensitive folders. Regularly test folder access to verify protections are in place.
Security tests
Read more
Header Security