Attackers tried to break into WordPress sites 62,969 times in a single day — not through a login page, but through a folder most site owners have never heard of. That folder is wp-content/upgrade, and it only exists for a few seconds at a time. If you learn how to block wp-content/upgrade in WordPress now, you can close that hole permanently, for every future update, in about five minutes.
Updating WordPress is supposed to make you safer — but in October 2026 researchers revealed the update process itself briefly opened a door. WordPress 7.1.4, released October 28, 2026, fixed the flaw, yet the update installing the fix can open the same door one last time on a still-vulnerable site. The permanent answer is a small server rule blocking the folder from the web.
What Is the wp-content/upgrade Folder — and Why Attackers Love It?
When WordPress installs a core update using a complete package, it unpacks the new files into a temporary staging folder under wp-content/upgrade. On versions 4.7 through 7.1.3, that folder name was predictable — and the staged copy included the WordPress installer itself, wp-admin/setup-config.php.
That combination is the whole problem: a guessable path, a live installer, and a web server happy to serve it.
An unauthenticated attacker who requested the staged installer at exactly the right moment could work toward running PHP code on the server — no login, no click from you required. Wordfence tracks the flaw as CVE-2026-119977 (rated 8.1, High). Its firewall rule caught the first attack request nine minutes after going live, logged over 18,500 requests aimed at staged installer paths in the first 21 hours, and later blocked 62,969 attempts in 24 hours.
In lab tests the staging folder existed for only seconds, so one lucky request rarely succeeds — attackers compensate with automated polling, hour after hour, waiting for an update window. As of late October 2026, Wordfence reported no confirmed break-ins from this flaw, but 62,969 blocked attempts is not a warning to ignore.
Why Updating Alone Is Not Quite Enough
You absolutely should update to WordPress 7.1.4 (or the matching release for your branch, such as 7.0.8 or 6.9.11 — fixes were backported to 4.7.39). Version 7.1.4 makes staging folder names unpredictable and restores index guards.
But here is the catch: the update to 7.1.4 is performed by the old updater.
On a site still running 7.1.3 or older, the upgrade unpacks the new package using the old, predictable logic — opening the window one final time. One tester measured the upgrade folder existing for 2.1 seconds during a normal update, long enough for the staged installer to answer requests. Hence the order: block the folder first, then update.
There is a second reason. A security plugin running inside WordPress cannot stop this attack, because the staged copy never loads your plugins — Patchstack states plainly that a PHP firewall cannot block it. Only a web-server or CDN rule sees the request first. And unlike a patch for one bug, blocking the folder also protects you against the next update-window flaw.
How to Block wp-content/upgrade in WordPress: The Safe Order
Before you touch any server file: take a complete backup (files plus database) and confirm it exists, and find out which server you run. Most shared hosting uses Apache or LiteSpeed; VPS servers often run nginx. On managed hosting you may not be able to edit server rules — ask your host whether it already blocks wp-content/upgrade; many do. Then add the rule, test it, and only then update.
Method 1: How to Block wp-content/upgrade in WordPress on Apache or LiteSpeed
If your site uses Apache or LiteSpeed, open the .htaccess file in your WordPress root folder — not inside wp-content/upgrade itself, since WordPress empties that folder during cleanup and a rule placed there would vanish.
Add these lines above the # BEGIN WordPress block:
# Block web access to the folders WordPress uses during updates
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-content/upgrade(-temp-backup)?/ - [F,L]
</IfModule>
The [F,L] flags return a 403 Forbidden and stop further rule processing. This version also covers wp-content/upgrade-temp-backup/, where WordPress keeps a copy of a plugin or theme during updates.
A real-world example: a small business owner on shared Apache hosting added this rule, then opened https://yoursite.com/wp-content/upgrade/ in a private window and got a clean 403 — while the homepage, blog, and contact form loaded normally. That is the result you want. WordPress still writes to the folder through PHP on the server itself, so blocking it costs you nothing.
Method 2: Block wp-content/upgrade on nginx
On nginx, add this block inside your site’s server block, before the PHP location:
location ^~ /wp-content/upgrade/ {
deny all;
}
The ^~ modifier matters: it tells nginx to stop here instead of passing the request to your PHP handler, which could otherwise still execute a .php file in the folder. After saving, test with nginx -t, reload with systemctl reload nginx, and verify that /wp-content/upgrade/ returns 403 while the rest of the site loads normally. Updates still complete normally — the rule blocks web visitors, not WordPress’s own file operations.
Method 3: Block wp-content/upgrade at Cloudflare or Your CDN
Behind Cloudflare, add a custom firewall rule blocking any request whose URI path starts with /wp-content/upgrade/ (available on the free plan). It stops probes before they reach your server — but keep the server-level rule too.
Which Method Should You Use? A Quick Comparison
| Method | Best for | Difficulty | What it blocks |
|---|---|---|---|
Apache/LiteSpeed .htaccess rule | Shared hosting, most small sites | Easy (2–4 lines) | All web requests to the upgrade folders |
nginx location block | VPS, cloud servers | Easy (3 lines, needs reload) | All web requests to the upgrade folder |
| Cloudflare/WAF rule | Any site behind a CDN | Easy (one rule) | Probes before they reach your server |
The key takeaway: no plugin replaces a server rule here, because the staged copy never loads your plugins. If you run Wordfence, enable Extended Protection mode — but Free users were scheduled to get this firewall rule only on November 27, 2026, a month after paying customers. The server rule closes that gap today, for free.
After the Block: Update, Then Check Your Logs
With the rule in place, the safe sequence is:
- Confirm the block works. Open
https://yoursite.com/wp-content/upgrade/in a private window. You want a 403 Forbidden; a file listing is the bad result. A blank page means theindex.phpguard is working, which is acceptable but weaker than a server 403. - Update WordPress to 7.1.4 or your branch’s fixed release.
- Check your access logs back to October 28, 2026, not just forward from the update. Normal visitors never request a PHP file under
wp-content/upgrade, so any such request is at least a probe. A 404 means the attacker missed the window; a 200 onsetup-config.phpduring an update deserves a full investigation. - Review user roles. Most other 7.1.4 fixes require a Contributor account or higher, so remove unused accounts and demote over-privileged roles.
If you spot signs of compromise, check our guide on how to check if your WordPress site is hacked before restoring or cleaning up. If server rules feel outside your comfort zone, see our services or contact us.
Frequently Asked Questions
What is the wp-content/upgrade folder in WordPress?
It is a temporary staging folder WordPress uses during core, plugin, and theme updates. WordPress unpacks packages there, moves files into place, then cleans up. After an update it should hold only an index.php guard file — or be empty.
Will blocking wp-content/upgrade break my WordPress updates?
No. The block only stops web browser requests. WordPress reads and writes to the folder through PHP on the server itself, which the rule does not touch — and testers confirm updates complete normally with it active.
Do I still need to update to WordPress 7.1.4 if I block the folder?
Yes. The rule closes the update-window path, but 7.1.4 fixes 22 vulnerabilities in total. The block is a shield; the update removes the underlying weaknesses. Do both.
Does a security plugin protect me from the WordPress 7.1.4 update vulnerability?
Not from this flaw. The staged installer loads its own files and never runs your security plugin, so a PHP-level firewall cannot see the request. You need a web-server or CDN rule — or Wordfence’s Extended Protection mode, which runs before WordPress loads.
The Punchy Takeaway
Your next WordPress update should be the most boring event in your site’s week — not a two-second window where attackers get a free shot at your server. That is how to block wp-content/upgrade in WordPress for good: add the server rule today, update to 7.1.4 second, and check your logs back to October 28 third. Five minutes of work, one permanent layer of protection, and the next update-window headline becomes somebody else’s problem — not yours.
Sources: WordPress 7.1.4 security release, WordPress.org, WordPress 7.1.4 update-window RCE analysis, WordPress 7.1.4 blocking guide and measurements.
