WP Protect Shell2

Adds defense-in-depth checks to WordPress uploads, sideloads, and wp_upload_bits() calls to block common executable extensions and PHP code in image uploads.

Description

WP Protect Shell2 hardens selected WordPress upload flows by checking filenames, blocking common script extensions (including suspicious multi-extension names), inspecting detected MIME types when PHP Fileinfo is available, and scanning common raster image uploads for PHP opening markers.

This plugin is one layer of defense. It does not guarantee detection of all web shells and does not patch vulnerabilities in WordPress core, themes, plugins, or server software. Some third-party upload handlers may bypass the WordPress upload filters used by this plugin.

Features

• Blocks common executable/script extensions, including PHP-family extensions.
• Checks all extension segments to reject names such as image.php.jpg.
• Rejects filenames containing path separators, traversal sequences, and control characters.
• Uses Fileinfo MIME detection when available; normal WordPress file validation remains in place.
• Scans common raster image contents for PHP opening markers, including short tags, without scanning documents or text files.
• Removes blocked extensions from the allowed WordPress MIME map.
• Checks WordPress upload and sideload prefilter hooks, and the wp_upload_bits() filter.

Installation

1. Back up your site.
2. In WordPress, go to Plugins > Add New Plugin > Upload Plugin.
3. Upload the plugin ZIP and activate it.
4. Test expected media uploads (images, PDFs, and other file types used by your site).

Security Notes

• Keep WordPress core, themes, plugins, and PHP patched.
• Configure the web server to prevent script execution in writable uploads directories. The exact configuration depends on Apache, Nginx, and the hosting environment.
• Use least-privilege filesystem permissions and a reputable malware scanner.
• Test on a staging site first. Image scanning can reject an image containing PHP opening-tag bytes. Documents, HTML/SVG/XML, and archives are not content-scanned; archives are not inspected internally, and WordPress's normal MIME and file-type policy still determines which formats a user may upload.
• The plugin cannot guarantee detection of malware or prevent execution of files already on the server. It does not replace patching WordPress, themes, plugins, or server software, malware scanning, or server-level controls.
• Upload handlers that write directly to disk or do not use the checked WordPress filters may bypass these checks. MIME detection is optional when Fileinfo is unavailable.

Frequently Asked Questions

Does this protect against every PHP shell or PHP2Shell vulnerability?

No. It blocks common upload patterns in selected WordPress upload flows. It cannot guarantee protection against all payloads, vulnerable third-party upload handlers, files written directly to disk, or execution of existing files.

Does it require PHP Fileinfo?

No. MIME inspection is performed when Fileinfo is available. Filename checks remain enabled, and the image-content scan is performed for the listed image extensions.

Can it block legitimate files?

Image files containing PHP opening-tag bytes may be rejected. PDF, text, and other document contents are not scanned, so PHP examples in those files are not blocked by the content scan. WordPress's normal MIME and file-type checks still apply.

Changelog

1.2.0

• Added checks for uploads using the wp_upload_bits() filter, including XML-RPC media upload flows.
• Limited PHP marker scanning to common raster image formats to avoid blocking PHP examples in documents and text files.
• Detects PHP short tags while excluding XML declarations.
• Rejects uploads explicitly if MIME or image-content inspection fails.
• Updated documentation to clarify upload-flow coverage and security limitations.

1.1.1

• Fixed filename validation and backslash handling.
• Added sideload prefilter coverage.
• Improved executable-extension checks and MIME-map filtering.
• Added bounded-memory scanning for common PHP code markers.
• Clarified security limitations and deployment guidance.

1.1.0

• Initial public-release candidate.