I would also suggest to add some validation to your file upload. Currently you are allowing arbitrary files to be uploaded. Even though it is password protected

I would also suggest to add some validation to your file upload. Currently you are allowing arbitrary files to be uploaded. Even though it is password protected, it is still trivial to brute force even with your sleep(3). The danger with allowing arbitrary file upload is someone can upload a script (PHP file for example) and run it basically allowing arbitrary code execution. This can lead to a whole slew of other issues. To get started, I would suggest: 1. Generating your own file names w/extension instead of relying on $_FILES['filetoupload']['name'] 2. After move_uploaded_file(), change file permissions to 644 to help mitigate possibility of file execution 3. Use getimagesize() to determine if file is indeed an image. It is still possible to embed code into a validate image to bypass getimagesize(), but #1 will help prevent Apache/etc from interpreting the file as PHP. 4. Ideally you would also strip metadata from the image file and only keep resized images and delete the originals. Also would suggest that you do not use the same password on your demo site as you have posted on Github.