Is it possible to change the default header.php file to something else for security reasons? It seems header.php is target for malicious attacks.

I know all that, we have different named headers, I am talking about the default one. For example instead of header.php rename it to imcool.php and I don't appreciate the negative point. All the default files index.php, admin as a user, header are always targets for malicious attacks including injection.

  • What kind of attacks? – Krzysiek Dróżdż Jul 30 '13 at 17:57
  • 4
    There is no security problem with header.php. – fuxia Jul 30 '13 at 18:00
  • 2
    I fail to see the security benefits of renaming that file, unless your header.php if very poorly written but if that is the case it needs to be rewritten not hidden. – s_ha_dum Jul 30 '13 at 18:05
  • See my edited text. – Nikolaos Vassos Jul 30 '13 at 18:16
  • Aaahh. I'm starting to understand what kind of attacks you're talking about, I guess. Do you mean some viruses that will modify your files? – Krzysiek Dróżdż Jul 30 '13 at 18:22

Yes, it is possible.

You can name this file whatever you want. In this case, you should use get_template_part instead of get_header to include this file in other templates.

Or you can name it header-something.php and then use get_header('something').

PS. I hope I haven't misunderstood your question.

| improve this answer | |
  • Though any file that uses get_header(), say a template file included by a plugin, will not work correctly. – s_ha_dum Jul 30 '13 at 18:03
  • @s_ha_dum Yes, that is the problem. Do you know any plugins that include theme files? – Krzysiek Dróżdż Jul 30 '13 at 18:11
  • I have seen a few. The idea is to provide a default template for some specialized data. This recent question on WPSE is attempting the same. – s_ha_dum Jul 30 '13 at 18:14
  • As long as wp_head is present, everything will work. Thanks Krzy, I will try your idea. – Nikolaos Vassos Jul 30 '13 at 18:17
  • @NikolaosVassos well, not exactly. If a plugin will call get_header and your theme doesn't have one, you'll get some problems. – Krzysiek Dróżdż Jul 30 '13 at 18:18

Split your file to whatever name you want to denote, i.e. xyz.php.

So, just include the page with:

<?php get_template_part('xyz'); ?>

Or, my-xyz.php:

<?php get_template_part('my', 'xyz'); ?>

It's that simple.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.