Is it good security advice to install wordpress in subdirectory but link to root?

Question

Is it good to install wordpress in a subdirectory (with a random name), but set "Homepage" address to domain root? (based on Giving WordPress Its Own Directory)

Since the wp-content is in the subdirectory and every link to photos and other files (including plugins css and js) in homepage, includes the full path of content folder.

Answer 1

Just to add to the answer by @birgire, check this post on how to hide the fact that you are using Wordpress.

I also think that no post basically covers this, but it really help nothing following and applying everything to hide the fact you are using Wordpress and to secure Wordpress, and your code in itself is a security risk.

Hackers are stubborn and always have a point to prove themselves that they can hack a site that they have set their mind on. The measures named in the linked post is just there to make it difficult for hackers, not to secure your site. Once hackers have the source code to your site, they can use bad, insecure code against you. For that reason, it is always very important to keep your site up to date and use only the latest code as set out in the docs, and regularly check for any code or practice that might create a loophole which hackers can exploit.

Answer 2

So you're asking if you install WordPress in a subdirectory, like example.tld/secretwp/ and have the site pointing to example.tld, it will keep "evil" users and bots from knowing about the subdirectory?

I don't think it will hold as a security advise, because your site can give away the subdirectory name in many ways. For example from:

• the use of admin-ajax.php, requests will be made to the example.tld/secretwp/wp-admin/admin-ajax.php file.

• the pingback, editURI and wlwmanifest link tags:

  <link rel="pingback" 
        href="http://example.tld/secretwp/xmlrpc.php" />
  
  <link rel="EditURI" type="application/rsd+xml" title="RSD"
        href="http://example.tld/secretwp/xmlrpc.php?rsd" />
  
  <link rel="wlwmanifest" type="application/wlwmanifest+xml" 
        href="http://example.tld/secretwp/wp-includes/wlwmanifest.xml" /> 
  

• the jQuery files included:

  <script type='text/javascript' 
          src='http://example.tld/secretwp/wp-includes/js/jquery/
               jquery.js?ver=1.11.1'></script>
  

• the native playlist javascript files included:

  <script type='text/javascript' 
          src='http://example.tld/secretwp/wp-includes/js/
               mediaelement/mediaelement-and-player.min.js?ver=2.15.1'></script>
   <script type='text/javascript' 
           src='http://example.tld/secretwp/wp-includes/js/
                mediaelement/wp-playlist.js?ver=4.1.1'></script>
  

and so on.

I don't think it's worth the effort trying to hide this info.