0

I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in wp-content and wp-includes. I then read about another hack that involved a backdoor file placed in the root directory. That got me thinking about how to extend the technique. Would it make sense to do something like this:

In root directory .htaccess:

<Files *.php>
    Order Deny,Allow
    Deny from all
</Files>

<Files index.php>
    Order Allow,Deny
    Allow from all
</Files>

In wp-admin .htaccess:

<Files *.php>
    Order Deny,Allow
    Allow from all
</Files>

I'm pretty sure this will break XML-RPC support as well as post by email, but I don't plan on using either of those technologies anyway. I'm wondering if there are other consequences that I'm not seeing (I don't know 100% what all of the PHP files in the root directory are for). Is this even worth it?

Improve this question
3
  • 2
    That would make no sense whatsoever.
    – Wyck
    Aug 13, 2013 at 3:35
  • @Wyck, thanks for the input. Could you maybe explain why it wouldn't make any sense?
    – Dominic P
    Aug 13, 2013 at 17:40
  • It just doesn't, it's like securing your house by bricking it over, no one does that for a reason.
    – Wyck
    Aug 13, 2013 at 17:53

1 Answer 1

Reset to default
1

No, it will not work.

You pretty much will disable php to work on your site admin.

On wp-admin there are files being executed when entering the admin side of the site.

Improve this answer
3
  • Won't the allow from all directive in the wp-admin .htaccess allow the admin area to work?
    – Dominic P
    Aug 13, 2013 at 7:36
  • Why would you add that .htaccess at all? It doesnt make any sense to use it in the first place. (You are adding an .htaccess to do ... nothing)
    – hacksy
    Aug 13, 2013 at 11:33
  • Maybe I'm missing something, but as I understand it, the root dir .htaccess will disallow direct access to any PHP file except index.php. This will cascade into subdirectories, so you override it with the .htaccess in wp-admin to allow the admin panel to work normally. It's basically an extension of the practices described here and here.
    – Dominic P
    Aug 13, 2013 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.