How-To: Lock Down wp-content/upgrade Before You Update WordPress

This is how I’m closing the update-window hole on self-hosted WordPress. Keep it generic and adapt it to your stack.

1. Nginx: in the server block, add location ^~ /wp-content/upgrade/ { deny all; }, then run nginx -t and reload.
2. Apache: add a <Directory> block for that path with Require all denied, or put RedirectMatch 403 ^/wp-content/upgrade/ above the rewrite rules in the root .htaccess.
3. Test: curl -I https://your-site/wp-content/upgrade/ should come back 403.
4. Update: wp core update, then wp core version and wp core verify-checksums.
5. Look around: check for unexpected admins (wp user list --role=administrator) and for a changed wp-config.php.
6. Automate it: if you manage servers with Ansible, put the deny rule in your web role so every site gets it.

WordPress works with that folder directly on disk, so blocking web access doesn’t break updates.

God Bless, and Use the Source!

References & Further Reading

• Installing the fix for an exploited WordPress flaw can expose some sites one last time (The Hacker News)
• *CISA says the WordPress core RCE is being exploited (EtherNinja)