https://blog.winhost.com/secure-upload-directory-with-iis-web-config/
https://blog.winhost.com/how-does-a-wordpress-site-get-hacked/
Separate names with a comma.