Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Is it possible to change the default header.php file to something else for security reasons? It seems header.php is target for malicious attacks.

I know all that, we have different named headers, I am talking about the default one. For example instead of header.php rename it to imcool.php and I don't appreciate the negative point. All the default files index.php, admin as a user, header are always targets for malicious attacks including injection.

share|improve this question
    
What kind of attacks? –  Krzysiek Dróżdż Jul 30 '13 at 17:57
4  
There is no security problem with header.php. –  toscho Jul 30 '13 at 18:00
2  
I fail to see the security benefits of renaming that file, unless your header.php if very poorly written but if that is the case it needs to be rewritten not hidden. –  s_ha_dum Jul 30 '13 at 18:05
    
See my edited text. –  Nikolaos Vassos Jul 30 '13 at 18:16
    
Aaahh. I'm starting to understand what kind of attacks you're talking about, I guess. Do you mean some viruses that will modify your files? –  Krzysiek Dróżdż Jul 30 '13 at 18:22
add comment

2 Answers

up vote 3 down vote accepted

Yes, it is possible.

You can name this file whatever you want. In this case, you should use get_template_part instead of get_header to include this file in other templates.

Or you can name it header-something.php and then use get_header('something').

PS. I hope I haven't misunderstood your question.

share|improve this answer
    
Though any file that uses get_header(), say a template file included by a plugin, will not work correctly. –  s_ha_dum Jul 30 '13 at 18:03
    
@s_ha_dum Yes, that is the problem. Do you know any plugins that include theme files? –  Krzysiek Dróżdż Jul 30 '13 at 18:11
    
I have seen a few. The idea is to provide a default template for some specialized data. This recent question on WPSE is attempting the same. –  s_ha_dum Jul 30 '13 at 18:14
    
As long as wp_head is present, everything will work. Thanks Krzy, I will try your idea. –  Nikolaos Vassos Jul 30 '13 at 18:17
    
@NikolaosVassos well, not exactly. If a plugin will call get_header and your theme doesn't have one, you'll get some problems. –  Krzysiek Dróżdż Jul 30 '13 at 18:18
show 3 more comments

Split your file to whatever name you want to denote, i.e. xyz.php.

So, just include the page with:

<?php get_template_part('xyz'); ?>

Or, my-xyz.php:

<?php get_template_part('my', 'xyz'); ?>

It's that simple.

share|improve this answer
    
Thank you, similarly to Krzysiek, I will try it. –  Nikolaos Vassos Jul 30 '13 at 18:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.