I am responsible for security of lots of shared hosting server. We have at least 500 wordpress website in each server.
Some of the website owners keep a weak password for WP admin or use vulnerable plugin/themes, this results in injecting a WP sites with malware.
Once website is injected with malware, It is used for sending spam emails or some other malicious activity.
Though, we have instructed 100 times to keep a tough password, sometime people don't listen properly.
One of my friend told me that, We can block the execution of uploaded PHP file using .htaccess, i.e providing access only to index.php in public_html & wp-admin
<Files *.php> Order Deny,Allow Deny from all </Files>
3 specific question about the problem
1) How can I block the execution of all other php files, except index.php in public_html & wp-admin ?
2) What modification is needed in the above .htacess file ? (Assume I am going to place it in all sub-folders in public_html)
2) Allowing only index.php in public_html & wp-admin is sufficient for the wordpress to function properly ?