Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644.

If there is any leak, what kind of please?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

No, there is no security risk. Both files do sanity checks before anything happens.

If WordPress is already installed:

  • install-helper.php returns just a blank page.
  • install.php says WordPress is installed and you should log in: enter image description here

You can forbid access to both files with a simple rule in your .htaccess above the permalink rules:

RedirectMatch Permanent wp-admin/install(-helper)?\.php /

This will redirect all requests to these files to the home page.

share|improve this answer
    
thanks for the details information. –  тнє Sufi Apr 21 '13 at 12:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.