Can’t stop file drops

Hi,

I’ve been testing your plugin to see if it can stop files being put onto the web server of a site. It looks like it is not able to do this or must it be set up in a particular way to prevent files being inserted into the website’s server folders?

Examples: .ico and php files are being put onto the site.
They are also able to inject php code into existing files, such as wp-settings (core files) and non-core php files.

Thank you,
Andre