I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in wp-content
and wp-includes
. I then read about another hack that involved a backdoor file placed in the root directory. That got me thinking about how to extend the technique. Would it make sense to do something like this:
In root directory .htaccess:
<Files *.php>
Order Deny,Allow
Deny from all
</Files>
<Files index.php>
Order Allow,Deny
Allow from all
</Files>
In wp-admin .htaccess:
<Files *.php>
Order Deny,Allow
Allow from all
</Files>
I'm pretty sure this will break XML-RPC support as well as post by email, but I don't plan on using either of those technologies anyway. I'm wondering if there are other consequences that I'm not seeing (I don't know 100% what all of the PHP files in the root directory are for). Is this even worth it?