Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

e.g.

curl -I http://ma.tt/blog/wp-config.php
200 OK

The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by Google)

Also, for file such as readme.html, it should be hidden as it disclose your wordpress version, e.g. http://ma.tt/blog/readme.html

So, currently I have selected several files and block in the web server level, e.g.

wp-config.php
wp-config-sample.php
license.txt
readme.html
 ..

But as there are so many files, especially under the wp-admin and wp-include folders, are there any better way to do it to improve security?

share|improve this question
    
How exactly are these files useless? Without the core files, WP wouldn't functions. wp-config.php, for example, is how you connect to your database. –  David Gard Nov 22 '12 at 15:48
1  
I think OP wants to show 404 page if they are being opened directly from a browser –  Mridul Aggarwal Nov 22 '12 at 16:08
2  
-1 "Useless" is really a bad choice of words... Please, review your old Questions, I've seen a couple of them fully answered and not marked as such... tip: 20% accept rate –  brasofilo Nov 22 '12 at 16:11
1  
Nice that you offer a bounty, but still don't tell what your exact goal is :P –  kaiser Nov 26 '12 at 17:58
1  
Preventing the files from being accessed directly and attempting to hide your WordPress version are not real security measures. They don't improve security one little bit. So if you're asking how to do it to improve security specifically, then there is no real answer to your question because doing those doesn't "improve security" in any way whatsoever. –  Otto Nov 27 '12 at 21:27
show 1 more comment

2 Answers

up vote 3 down vote accepted

I wouldn't bother with the readme file as probably no hacker bothers to check your WP version before trying to hack into the site. Will not bother with anything in /wp-includes and /wp-admin because I trust the core team to make that code secure in the default installation, and those file don't contain any information which is specific to my site.

The files to protect are wp-config.php, because it contains DB access details and the /wp-content directory because theme and plugins developers are not very good at security. for wp-config just deny access in your .htaccess

<files wp-config.php>
order allow,deny
deny from all
</files>

for /wp-content/plugins and /wp-content/theme deny access for anything which is not animage,js or css file by adding an .htaccess there with the following content. If a plugin or theme does not work with this configuration they probably don't follow WP coding guidelines and it might be better not to use them.

<Files ^(*.jpeg|*.jpg|*.png|*.gif|*.js|*.css)>
   order deny,allow
   deny from all
</Files>

for /wp-content/uploads you can't realy deny access as you don't know which type of files will be uploaded there, so the best thing to do there is to simply not to allow the execution of php,perl,pyton at that directories and serve them as plain text with the following rules

<FilesMatch "\.(php|pl|py|jsp|asp|htm|shtml|sh|cgi)$">
ForceType text/plain
</FilesMatch>

Once you are satisfied, you should probably combine everything to one .htaccess at root for better performance

share|improve this answer
    
+1, nice write-up, although the correct answer is what Otto writes in the Q's comments: "there is no real answer" ;) –  brasofilo Dec 2 '12 at 2:54
    
@brasofilo, the reason I wrote the answer was because I disagreed with otto. In the specific context of the question, preventing execution of scripts which were uploaded to the server is important security measure as even if there is a security breach through a plugin or insecure shared server, the uploads directory is the easiest target for the hacker to install his code and breach further into your site. So sure, those steps are far from being the alpha and omega of WordPress security but your security is better if you implement them. –  Mark Kaplun Dec 2 '12 at 14:41
    
1. The first thing a hacker checks is the version. 2. Never trust anyone, don't assume the core is secure. 3. You can protect wp-config by moving outside the web root. The other suggestions are moot. –  Wyck Dec 2 '12 at 17:50
    
@Wyck, 1. then you never need to upgrade just change your generator string and readme file. 2. if core is not secure then WordPress should not be used as CMS for anything that is really important to you. 3. wordpress.stackexchange.com/questions/58391/… and codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php IMO both methods are basically the same, but moving the file requires more mental work. –  Mark Kaplun Dec 2 '12 at 19:44
add comment

First a correction, if you block the files under wp-admin, you won't be able to use the wordpress admin panel. Though you can block the files under "wp-admin/includes" folder

Now the solution:-
You don't need to type all the names, you can use regular expressions to block a pattern of files for ex. it's easy to write a regular expression to block all the files which reside in the wp-includes folder.

If you don't have other files in the same wordpress directory, then instead of blocking specific files, you can go through to the whitelist approach i.e. allow only specific files. Specifically you'll allow only the files which reside inside the wp-admin & wp-content folder & of course the main wordpress file(index.php)

If your themes & plugins don't use any dynamically generated files, you can just block all php files from direct access except those in wp-admin & index.php

Whatever approach you take, just remember to only block php files & not anything else, otherwise the browser won't be able to load all the admin panel's CSS & the javascript.

share|improve this answer
    
Blocking of wp-include is not a solution as it will block script such as jQuery (wp-includes/js/jquery/jquery.js) –  Yoga Nov 23 '12 at 18:11
    
The last paragraph clearly says to block only php files & nothing else –  Mridul Aggarwal Nov 23 '12 at 18:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.