Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote 3 down vote favorite
2

WordPress itself, in the wp-content folder, includes an empty PHP file which looks like this.

<?php
// Silence is golden.
?>

Should plugins include an empty file like this as well to stop folks view viewing the contents of a directory? What about additional folders in themes -- like an includes directory?

share|improve this question
1  
yes, it's probably a good idea. Never understood why WP doesn't have Options –Indexes in the bundled htaccess, so these files wouldn't be necessary... – One Trick Pony Mar 13 '12 at 1:45

2 Answers

up vote 3 down vote accepted

I am going to say YES. Security through obscurity works if your more obscure then your neighbors :) (joking but there is some truth to that).

The reality is that the bots/scanners now compile the plugin lists right off wordpress.org and crawl the plugin url's directly, fingerprinting versions for know exploits and keeping the info in a database for reference.

So which would you rather, a bot not being able to gather info on your install, or leaving it up to the plugin author to make sure your secure. How about both.

ps. On a side note there were 186 reported exploits from wordpress.org plugins last year .(*reported..).

share|improve this answer
Exploit scanners do not test if the plugin exists. They try to run the exploit during the first request. An empty index.php would not protect anything, you would just get a false sense of security. – toscho♦ Mar 13 '12 at 2:16
But they do, wp-scan (one of many) fingerprints over 2200 plugins for example, and uses some decent fingerprinting to detect versions (file size, file additions, etc). – Wyck Mar 13 '12 at 2:20
I’ve cleaned up dozens of hacked WordPress sites. Almost always the first request was a real attack. That’s just reasonable: Why wasting time with a detailed scan if you can test the vulnerability in the first request? Track your 404s to see it. :) – toscho♦ Mar 13 '12 at 2:25
1  
I agree, this should be up to the end user and not the author. But I don't think it hurts either. I just wanted to add a counter-point since you said "no". – Wyck Mar 13 '12 at 2:36
1  
marked this one as accepted because of the comment debate! – chrisguitarguy Mar 22 '12 at 2:49
show 2 more comments
up vote 4 down vote

No, they should not. If a plugin has vulnerabilities just because someone might see its directory structure it is broken. These bugs should be fixed.
Security through obscurity is a bug for itself.

Its up to the site owner to allow or forbid directory browsing.

share|improve this answer
1  
"Its up to the site owner to allow or forbid directory browsing." That's probably the key point. – chrisguitarguy Mar 13 '12 at 1:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.