Block Run PHP File in WordPress Storage Folder (Uploads)

.htaccess

# Block executables
<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|html|htm|shtml|sh|cgi|suspected)$">
    deny from all
</FilesMatch>

plugin.php

<?php

add_action('generate_rewrite_rules', 'create_htaccess_uploads_dir');
function create_htaccess_uploads_dir(): void
{

    $uploads_dir = wp_upload_dir(null, false);
    $file = $uploads_dir['basedir'] . '/.htaccess';
    if (file_exists($file)) {
        @unlink($file);
    }

    $content = '# Block executables' . "\n";
    $content .= '<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|html|htm|shtml|sh|cgi|suspected)$">' . "\n";
    $content .= 'deny from all' . "\n";
    $content .= '</FilesMatch>';
    file_put_contents($file, $content);
}

define('DISALLOW_FILE_EDIT', true);