Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed directly via HTTP. For instance, http://MYSITE/blog/xmlrpc.php needs to remain directly accessible, but there's no reason why http://MYSITE/blog/wp-load.php shouldn't give a 404.

The question is: Where do I get a complete list of stock Wordpress .php files that can legitimately appear in URLs?

Also, I use mod_rewrite to remove the top-level index.php from all my published URLs -- does that mean I can block direct use of http://MYSITE/blog/index.php?whatever?

share|improve this question

1 Answer 1

Correct me if I'm wrong, but far as I know, You don't access directly to any of the files, the apache user does. Meaning, the user browser talks to the server's httpd process which will get the file from the filesystem. So, i think that if you get a 404 on the browser when directly requesting a file, you will get the same 404 error when using the links on the wordpress pages.

I understand your point, I just don't know if it is possible.

About blocking requests based on the address, I think you should look at the specs of the .htaccess file. The Wordpress uses this file to config the permalinks.

share|improve this answer
    
Right, any .php file that can appear in a hyperlink needs to be accessible via HTTP. But the vast majority of Wordpress's .php files are only used via require-type statements in the PHP code, which bypasses the web server's access permissions. Those files don't need to be valid HTTP GET destinations, and it might improve security to prevent them. I know how to write an .htaccess file that blocks access to files, I just need the list of .php files that shouldn't be denied. –  Zack Mar 6 '12 at 15:56
    
Correcting you, because you're wrong. When you visit http://mysite.url/ you're really accessing http://mysite.url/index.php directly. Also in the admin, you access /wp-admin/index.php directly. When viewing post lists you access /wp-admin/edit.php directly. Etc ... –  EAMann Jan 20 '13 at 4:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.