WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to move the entire wp-content folder outside of the Web root? I need to prevent anyone to view any asset file (images, pdfs, movies etc) with a direct url to the file... Any ideas? Or could I do this safely with htaccess?

share|improve this question
up vote 3 down vote accepted

See Ben Word - How to Hide WordPress


In the Roots Theme we’re taking several steps to help make it not so obvious that you’re using WordPress:

  1. Cleaning up the output of wp_head and removing the generator from RSS feeds
  2. Hiding /wp-content/ by rewriting static theme assets (CSS, JS, and images), rewriting the plugins directory, and also changing the location of WordPress uploads
  3. Cleaning up the output of navigation menus with a custom walker
  4. Bonus: root relative URLs
share|improve this answer
Great link with lots of good info! – Brian Fegter Feb 8 '12 at 16:43
Thanks songdogtech - very interesting stuff in there. – Regis Zaleman Feb 9 '12 at 16:41
Here's a direct link to the article: How to Hide The Fact That You’re Using WordPress – Ian Dunn Jul 13 '12 at 15:10

I would highly recommend that you NOT move wp-content outside of the docroot. WordPress utilizes wp-content for more than uploads. This would have a huge impact on the accessibility of themes and plugins.

WordPress uploader will not play well with this scenario, and you're only allowed to add an alternate relative relative path to the WordPress URI as well (Settings->Media), which means WordPress is constricted to uploading to the docroot. This makes sense because 99.99999999% of sites would never need this functionality.

This would be a bear of a project to tackle within WordPress from scratch. I would recommend that you use Amazon S3 and install a plugin like CDN Vault. They claim to protect locally hosted files and cloud hosted files on S3. I haven't verified either, but it looks like a good start.

Hope this helps you out!

share|improve this answer
Makes sense, thanks a lot Brian. – Regis Zaleman Feb 9 '12 at 16:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.