Hiding Directory Path

Question

I'm not sure if I am wording this right, but I need to hide the directories of my Wordpress installation.

What I mean is, I am able to go to, say:

www.example.com/wp-content/uploads/2012/08 

...and see all my uploads to my site this month. Anyone can access this from any pc. I want to block this, so that people can only see what is available on my site's pages and posts, without being able to access the filesystem of my website.

Of course, not every file in my root directory can be accessed, so maybe it's normal that anyone can access my uploads.

Just a little confused, and would appreciate it if someone could clear this up for me.

Thanks!

Answer 1

The easiest way to achieve this is to add,

Options -Indexes

..to your .htaccess file.

Specifically your .htaccess file should look like this,

# BEGIN WordPress
Options -Indexes 
...etc
...etc
# END WordPress

This is one way and probably the most efficient way.

This method will prevent any direct access outside of blog posts, pages, or template files which call any images or files from this directory.

A usual read overall: http://httpd.apache.org/docs/current/mod/core.html

Access to the /uploads/ folder should not pose a security risk, in theory, (retracted aforementioned statement - if your permissions are set incorrectly you may expose yourself to harm)