Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's been a long time since I've done any web-development, and I never needed to administer a server myself. However, I can read manuals with the best of them, and when someone needed advice regarding a wordpress installation vulnerable to the TimThumb exploit, I told them to add the follwing to their httpd.conf:

<Directory "/path/to/cache/directory">

    # disallow changing options with a .htaccess file within the cache directory
    AllowOverride None

    # disable all extra features, including CGI scripting
    # prevents malicious code from running
    Options None

    # don't let users browse cached files
    # prevents the attacker from triggering script execution
    Deny from all

    # explicitly disable php - shouldn't be necessary, but just in case ;)
    php_flag engine off


Was that advice sound? In particular, is this the correct choice of directives to prevent any script execution?

share|improve this question
up vote 4 down vote accepted

Yes, those directives will effectively prevent script execution for any malicious scripts which may be written to that directory, however, you should definitely look at patching or removing any scripts which allow drive-by uploads to your cache directory from unauthenticated or untrusted users.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.