WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in wp-content and wp-includes. I then read about another hack that involved a backdoor file placed in the root directory. That got me thinking about how to extend the technique. Would it make sense to do something like this:

In root directory .htaccess:

<Files *.php>
    Order Deny,Allow
    Deny from all

<Files index.php>
    Order Allow,Deny
    Allow from all

In wp-admin .htaccess:

<Files *.php>
    Order Deny,Allow
    Allow from all

I'm pretty sure this will break XML-RPC support as well as post by email, but I don't plan on using either of those technologies anyway. I'm wondering if there are other consequences that I'm not seeing (I don't know 100% what all of the PHP files in the root directory are for). Is this even worth it?

share|improve this question
That would make no sense whatsoever. – Wyck Aug 13 '13 at 3:35
@Wyck, thanks for the input. Could you maybe explain why it wouldn't make any sense? – Dominic P Aug 13 '13 at 17:40
It just doesn't, it's like securing your house by bricking it over, no one does that for a reason. – Wyck Aug 13 '13 at 17:53

No, it will not work.

You pretty much will disable php to work on your site admin.

On wp-admin there are files being executed when entering the admin side of the site.

share|improve this answer
Won't the allow from all directive in the wp-admin .htaccess allow the admin area to work? – Dominic P Aug 13 '13 at 7:36
Why would you add that .htaccess at all? It doesnt make any sense to use it in the first place. (You are adding an .htaccess to do ... nothing) – Hansy Schmitt Aug 13 '13 at 11:33
Maybe I'm missing something, but as I understand it, the root dir .htaccess will disallow direct access to any PHP file except index.php. This will cascade into subdirectories, so you override it with the .htaccess in wp-admin to allow the admin panel to work normally. It's basically an extension of the practices described here and here. – Dominic P Aug 13 '13 at 17:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.