Comment by bombcar

    # BEGIN php2shell-mitigation
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:Content-Type} multipart [NC]
    RewriteRule .* - [F,L]
    </IfModule>
    <If "%{HTTP:Content-Type} =~ /multipart/i">
    Require all denied
    </If>
    # END php2shell-mitigation

and for caddy

    @multipart header_regexp Content-Type (?i)multipart
    respond @multipart 403

    @uploads_php path_regexp uploads_php ^/(?:.*/)?wp-content/uploads/.*\.php(?:/.*)?
    respond @uploads_php 404

Next will be block everything but GET, then static site copy, then administratively down