Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I installed latest WordPress 3.5 in my CentOS server. When I tried accessing http://example.com/wp-includes/, I received a listing of the directory: (Index of wp-includes).

I added the following code at the top of .htaccess file, and it fixed the issue:

Options -Indexes
IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

My problem

When I try accessing PHP files in wp-includes and wp-content using a web-browser (for example: http://example.com/wp-includes/class-smtp.php), it shows a blank screen. I think it should show "Permission denied" or something like this. Am I correct?

How can I achieve this? I'm concerned if my website is vulnerable to attacks. I am already aware of the Hardening WordPress article.

Here are my directory and file permissions:

  • wp-admin: 755
  • wp-content: 755
  • wp-includes: 755
  • Files have permission 644
share|improve this question
3  
Server response has nothing to do with security, what can you do with a blank screen and only read access, nothing. –  Wyck Dec 18 '12 at 23:30

2 Answers 2

up vote 5 down vote accepted

The PHP files in the wp-includes directory will do nothing when accessed directly. They are designed to be include()'d in an existing PHP script, such as on the front-end or in the dashboard.

Your Options -Indexes entry in the .htaccess file simply prevents a list of the files in a directory when no index.php is present. It's good practice to use this on a live server. I'm not entirely sure what the second line does; you should most likely remove it.

If you're especially concerned about people attacking your server, you can prevent access to the wp-includes directory completely. To do this, create a .htaccess file inside the wp-includes folder with the following content:

Deny from all
share|improve this answer

If you want to protect your WordPress installation, one thing that I always do when I install WordPress is to protect my wp-admin folder (your login page). What I do is I create .htaccess file in wp-admin and allow only certain IPs to access this folder. I think there's some info on WordPress login page here: htaccess redirect

Also who is your host? Did you set this server up yourself? You should not be seing your index of wp-includes after you install WordPress. It has never happened to me before. :/

share|improve this answer
    
The login page (wp-login.php) isn't part of wp-admin –  bungeshea Jan 17 '13 at 6:28
    
Yes you are correct. I should have explained this a little better. You can still access your login page by going to domain.com/wp-login.php however, if you do allow only certain IPs to access the wp-admin folder, the ones that are not on the list will get a 403 , permission denied error. –  beacon Jan 17 '13 at 15:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.