Timeline for Should Plugin Folders Include a Blank index.php File?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Nov 3, 2016 at 4:55 | history | suggested | zahypeti | CC BY-SA 3.0 |
fixed typos
|
| Nov 3, 2016 at 1:41 | review | Suggested edits | |||
| S Nov 3, 2016 at 4:55 | |||||
| Mar 22, 2012 at 2:49 | comment | added | chrisguitarguy | marked this one as accepted because of the comment debate! | |
| Mar 22, 2012 at 2:48 | vote | accept | chrisguitarguy | ||
| Nov 26, 2019 at 3:47 | |||||
| Mar 13, 2012 at 2:36 | comment | added | Wyck | I agree, this should be up to the end user and not the author. But I don't think it hurts either. I just wanted to add a counter-point since you said "no". | |
| Mar 13, 2012 at 2:33 | comment | added | fuxia♦ | The question is about recommendations for plugin authors. You, as an author, should fix security holes, not hide them. That’s my recommendation at least. | |
| Mar 13, 2012 at 2:27 | comment | added | Wyck | I agree, but you also know that a lot of this is about gathering data. And the reality is that there are over 10k plugins in the repo and many users that can't lock a box down or are just lazy. | |
| Mar 13, 2012 at 2:25 | comment | added | fuxia♦ | I’ve cleaned up dozens of hacked WordPress sites. Almost always the first request was a real attack. That’s just reasonable: Why wasting time with a detailed scan if you can test the vulnerability in the first request? Track your 404s to see it. :) | |
| Mar 13, 2012 at 2:20 | comment | added | Wyck | But they do, wp-scan (one of many) fingerprints over 2200 plugins for example, and uses some decent fingerprinting to detect versions (file size, file additions, etc). | |
| Mar 13, 2012 at 2:16 | comment | added | fuxia♦ |
Exploit scanners do not test if the plugin exists. They try to run the exploit during the first request. An empty index.php would not protect anything, you would just get a false sense of security.
|
|
| Mar 13, 2012 at 1:59 | history | answered | Wyck | CC BY-SA 3.0 |