A theme author has confirmed that in their next update (sometime soon), they'll include code to restrict access to theme files, e.g. functions.php over HTTP.

In the meantime, I've tested the following below methods, which seem to work without error.

Prior to using the below methods, any direct access to such files resulted, of course, in an Include Directive error, which also exposed the server path.

My aim is to disallow users direct access to themes and plugins PHP files over HTTP (or indeed any other protocol as far as is possible).

The only issue with using PHP like this is needing to add the snippet to every PHP file within themes and plugins.


If the PHP approach is better suited, is there a more efficient (quicker) way of applying this to all PHP files within /wp-content/themes & plugins?

Or, are both the PHP and .htaccess methods equally valid?


// prevent direct access to functions.php in wordpress
if (
  ! empty( $_SERVER['SCRIPT_FILENAME'] )
  && 'functions.php' == basename( $_SERVER['SCRIPT_FILENAME'] )
) {
    die( 'Error!' );


// prevent direct access to functions.php in wordpress
if ( ! defined( 'ABSPATH' ) ) die( 'Error!' );`


<FilesMatch "\.(php)$">
 Order Allow,Deny
 Deny from all

I added this snippet to a .htaccess file and placed one into /wp-content/themes/ and another into /wp-content/plugins/.

Whenever I try accessing any theme or plugin PHP files over HTTP, the Forbidden. You don't have permission to access notice is displayed - seems perfect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.