Strange PHP files in wp-content/uploads

PHP files in wp-content/uploads are out of place. That folder is WordPress's media library for images and documents, not code the site needs to run. If PHP shows up there, keep it in a backup, remove it from the live site, and find what was able to write it.

What you are seeing

In SFTP, the file manager, or a host scan, files ending in .php sit inside wp-content/uploads. The ending may instead be .phtml, .php5, .php7, or .phar. The name may look like an image with an extra extension, or like a random string. The date may be newer than any upload you remember. A subfolder may hold many of them beside a normal photo.

A very small index.php can be intentional. Hardening plugins add an almost empty index file so a folder listing shows nothing. That file is a few lines and does not reference your pages. Anything longer, anything you cannot read, and anything that is not an index is a different case.

A suspension that names uploads is often this symptom. A Deceptive site ahead warning can point at one URL here while the rest of the site looks ordinary.

Why it happens

Uploads has to be writable, or you could not add media. On many hosts it is also executable, so a PHP file there runs when someone requests it. That is why unwanted scripts land in a media folder.

A compromised plugin, an administrator session, or another site on the same account can write the file. You do not need to classify it. If you did not put it there, take it off the live site.

The file is rarely the original door. Leave an unknown administrator, an old password, or a tampered plugin, and a new file appears. See how WordPress sites get compromised. Also check wp-content/mu-plugins. Block execution and delete the file. A file that cannot run can still be a public URL you do not want.

How to check if you are affected

The scanner below is read-only and only sees public URLs. Many PHP files in uploads are not linked from the homepage, so a scan can miss them. A listing over SFTP is the check that counts.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. Open wp-content/uploads over SFTP. Sort by date. Search for php, phtml, php5, php7, and phar, including each year folder. Include names with two extensions.
2. Open any .htaccess inside uploads. Note rules you did not add. Do not ask a stranger to run those rules for you.
3. Compare what you found with plugins you use. A backup plugin that documents files in uploads is a possible benign case, and the file should match that documentation.
4. Prefer reading a suspicious file as text in an editor. Do not upload it elsewhere "to see what it does," and do not request it in a browser if you do not already know it is harmless. If the text is unreadable to you, stop reading and remove it.
5. List administrators and recent plugin installs. Check wp-content/mu-plugins for PHP you did not mean to load.
6. If the host sent paths, start there, then search the rest of uploads so you are not cleaning only the one file they named.

An empty index.php that you or a known plugin added can stay. When you are unsure, copy it into the backup and remove it. Images should still load.

How to fix it yourself

1. Isolate the site if those PHP URLs are public, or if the host is about to suspend you.
2. Back up the files first, including the strange ones. Label the copy so nobody restores it as clean.
3. Delete unexpected PHP from wp-content/uploads. Leave ordinary media. If a folder is only PHP and spam HTML, remove it after the backup.
4. Stop PHP in uploads. On Apache, deny .php and .phtml in that folder's .htaccess, then test an image URL. Nginx ignores .htaccess, so ask the host.
5. Replace WordPress core from wordpress.org: wp-admin, wp-includes, and root files such as index.php and wp-login.php. Keep wp-config.php. Do not delete wp-content.
6. Remove administrators you do not recognize, after checking with your developer or host.
7. Replace themes and plugins from clean copies. A changed plugin often writes these files. Reinstall from the official zip rather than updating a folder you do not trust.
8. Reset administrator, SFTP, hosting, and database passwords. Keep DB_PASSWORD in wp-config.php matched. Replace salts from the WordPress secret-key service.

DIY is a bad idea with no backup, if the files return, or if the host suspended the account before you could download them. You do not need to understand every line. See how to clean a hacked WordPress site.

When to get help

Get help when uploads holds more PHP than you can sort, when the files come back, when the host's list and yours do not match, or when you also cannot log in. If you ask for advice in public, send paths, not the contents of the files.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean again, or we refund the fee if we cannot clean it. We start only after you confirm you own the site. There is no timer. Email daniel@daniellasek.com or use the button below.

Fix it now — $499 Talk to us by email

FAQ

Are all PHP files in wp-content/uploads malware?

Treat them as untrusted until you know otherwise. WordPress does not need PHP there to store images. A tiny index.php left by a security plugin is a known exception. A file you cannot explain is not an exception.

Is it safe to download a strange PHP file from uploads and open it?

Do not run it, and do not upload it to another server to see what happens. You can read it as text if you know PHP. If you do not, leave it only inside your backup and remove it from the live uploads folder.

Will blocking PHP in uploads break images or the media library?

Images, PDFs, and other media do not need PHP to execute. Blocking PHP in wp-content/uploads is normal hardening. Test a few media URLs after you add the rule. A plugin that expected to run code there may need a setting change.

PHP files reappeared in uploads the next day. What did I miss?

The uploads folder was where the files were stored, not how they got there. An unknown administrator, an old password, or a changed plugin can write them again. Reset those and replace anything that does not match a clean copy.