Prevent code execution in the public ‘Uploads’ folder

@elgopa can you check if the .htaccess file in the uploads directory has been added, and the htaccess lines included in that file?

You can find the .htaccess file in wp-content/uploads

@elgopa yes, that file is a test file. Can you disable and enable the option again to check if it can write on the second try? As the test file is there, it seems there are writing permissions.

i already tried several times, maar helaas…

(pitty also you have only the option “Enable recommended hardening features in Really Simple SSL – Enable” once when logging in after the update, and by the way after you do this you can not disable these options anymore)

I just double checked, I can disable the options without issues. In some cases, if the plugin detects an option is already handled, it will show as “on”, but disabled. Possibly that is the case here.

To make things even more complicated for you guys;

One third site does not have a .htacces file in /uploads folder, but does not give the warning “Prevent code execution in the public ‘Uploads’ folder”

It is possible the code execution option is already blocked by either the hosting company or another plugin. In that case the notice won’t show up.

You do not have the option “do not edit htaccess” enabled? (just checking).

If you’re interested I can make a version with some logs. If you then post back the resulting log file, we can see where the plugin skips the .htaccess generation.

I don’t get what you mean with

option is already handled, it will show as “on”, but disabled

buttons have a lighter green colour than normal,after enabling the recommended options once, and cannot be disabled

You do not have the option “do not edit htaccess” enabled? (just checking).

That’s the culprit!
I always had that enabled, because i did edit the .htaccess myself!

thank you!

@elgopa

For example, if debugging is disabled on your site, and there’s not debug.log file in the wp-content folder, the option “change debug log location” will show as “enabled” (because there is no issue currently). As the option is not enabled in Really Simple SSL, the option is disabled, which shows as the lighter color.

So if you see an enabled option with a lighter color, this means it is disabled in Really Simple SSL, but this specific security feature is already handled in some other way, like by setting the WP_DEBUG constant to false.