I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in
wp-includes. I then read about another hack that involved a backdoor file placed in the root directory. That got me thinking about how to extend the technique. Would it make sense to do something like this:
In root directory .htaccess:
<Files *.php> Order Deny,Allow Deny from all </Files> <Files index.php> Order Allow,Deny Allow from all </Files>
In wp-admin .htaccess:
<Files *.php> Order Deny,Allow Allow from all </Files>
I'm pretty sure this will break XML-RPC support as well as post by email, but I don't plan on using either of those technologies anyway. I'm wondering if there are other consequences that I'm not seeing (I don't know 100% what all of the PHP files in the root directory are for). Is this even worth it?