WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not sure if I am wording this right, but I need to hide the directories of my Wordpress installation.

What I mean is, I am able to go to, say:


...and see all my uploads to my site this month. Anyone can access this from any pc. I want to block this, so that people can only see what is available on my site's pages and posts, without being able to access the filesystem of my website.

Of course, not every file in my root directory can be accessed, so maybe it's normal that anyone can access my uploads.

Just a little confused, and would appreciate it if someone could clear this up for me.


share|improve this question

The easiest way to achieve this is to add,

Options -Indexes

..to your .htaccess file.

Specifically your .htaccess file should look like this,

# BEGIN WordPress
Options -Indexes 
# END WordPress

This is one way and probably the most efficient way.

This method will prevent any direct access outside of blog posts, pages, or template files which call any images or files from this directory.

A usual read overall: http://httpd.apache.org/docs/current/mod/core.html

Access to the /uploads/ folder should not pose a security risk, in theory, (retracted aforementioned statement - if your permissions are set incorrectly you may expose yourself to harm)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.