Protection against Web Shells on Windows

Question

Information Security

There is a xampp Web server on Windows 7.

When uploading a web shell, an attacker is given the opportunity to view all the files and disks of the computer.
How to prevent it? What would prevent an attacker from viewing files in addition to the web directory?

There is no portability to Linux or another server.

Answer 1

Option 2:
1) Set permissions
2) Antivirus
The 1st option is universal, it will help against any shell, but setting the access rights correctly will be very stressful ...
The 2nd option will only help against common shells (r57, etc.), but won't even look at the self-written one...

Answer 2

prohibit writing to folders for the user under which Apache is running, and from which script execution is allowed