To restrict PHP files execution in your upload folder when using IIS on windows server, you just need to upload a web.config file in your “upload” folder with below mentioned content: For more detailed explanation, just check here: http://www.wptricks24.com/disable-php-files-upload-folder-wordpress-iis This is a very nice article for same situation you are facing.