Load all files from folder in theme – Security concerns?

Question

I'm using this code below in a config file to automatically require other PHP files in the same directory and in subdirectories. This helps my work flow become more efficient. I'm concerned that I should be using more wordPress security features in this code as I'm currently using none. Can someone recommend some wp security enhancements for this code if there are any?

<?php 
$theme_path = 'wp-content/themes/' . get_template() . '/acf';
$theme_path_admin = '../wp-content/themes/' . get_template() . '/acf/';
if (!is_admin()) {

  $filepath= new SplFileInfo($theme_path);
} else {
  //filepath from admin

$filepath= new SplFileInfo($theme_path_admin);
}
req_php_files($filepath->getRealPath()); ?>

Answer 1

Only so much security can be added at the php layer. To gain even more security, modify the .htaccess file, disabling directory browsing, disabling XML-RPC, and deny access to WP-specific files.

    <files .htaccess>
        Order allow,deny
        Deny from all
    </files>
    <files readme.html>
        Order allow,deny
        Deny from all
    </files>
    <files readme.txt>
        Order allow,deny
        Deny from all
    </files>
    <files install.php>
        Order allow,deny
        Deny from all
    </files>
    <files wp-config.php>
        Order allow,deny
        Deny from all
    </files>

    # Rules to disable XML-RPC
    <files xmlrpc.php>
        Order allow,deny
        Deny from all
    </files>

    # Rules to disable directory browsing
    Options -Indexes

Don't want ../pxs/wp-content/uploads/ open to the web, after all. What if you uploaded a contract with significant details or something?

---

Banning the HackRepair.com Blacklist in your .htaccess file is a good idea too. Here's what the beginning of that'd look like:

    RewriteEngine on
    RewriteCond %{HTTP_USER_AGENT} ^[Ww]eb[Bb]andit [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Acunetix [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^binlar [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^BlackWidow [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Bolt\ 0 [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:craftbot\@yahoo\.com [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^BOT\ for\ JCE [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^casper [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^checkprivacy [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw [NC,OR]