I'm using this code below in a config file to automatically require other PHP files in the same directory and in subdirectories. This helps my work flow become more efficient. I'm concerned that I should be using more wordPress security features in this code as I'm currently using none. Can someone recommend some wp security enhancements for this code if there are any?

$theme_path = 'wp-content/themes/' . get_template() . '/acf';
$theme_path_admin = '../wp-content/themes/' . get_template() . '/acf/';
if (!is_admin()) {

  $filepath= new SplFileInfo($theme_path);
} else {
  //filepath from admin

$filepath= new SplFileInfo($theme_path_admin);
req_php_files($filepath->getRealPath()); ?>
  • This is a pretty broad question... what specifically are you worried about? Where is this file used?
    – Tim Malone
    May 10, 2016 at 23:09
  • its used in a wordpress theme, im worried about not following best practice security enhancements May 10, 2016 at 23:14
  • im looking for some sort of sanitation of the files before they get included so thats its not malicious. May 10, 2016 at 23:25
  • Where are the files coming from? Do you control them?
    – Tim Malone
    May 10, 2016 at 23:34
  • Yes i control the files that are being imported May 18, 2016 at 5:17

1 Answer 1


Only so much security can be added at the php layer. To gain even more security, modify the .htaccess file, disabling directory browsing, disabling XML-RPC, and deny access to WP-specific files.

    <files .htaccess>
        Order allow,deny
        Deny from all
    <files readme.html>
        Order allow,deny
        Deny from all
    <files readme.txt>
        Order allow,deny
        Deny from all
    <files install.php>
        Order allow,deny
        Deny from all
    <files wp-config.php>
        Order allow,deny
        Deny from all

    # Rules to disable XML-RPC
    <files xmlrpc.php>
        Order allow,deny
        Deny from all

    # Rules to disable directory browsing
    Options -Indexes

Don't want ../pxs/wp-content/uploads/ open to the web, after all. What if you uploaded a contract with significant details or something?

Banning the HackRepair.com Blacklist in your .htaccess file is a good idea too. Here's what the beginning of that'd look like:

    RewriteEngine on
    RewriteCond %{HTTP_USER_AGENT} ^[Ww]eb[Bb]andit [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Acunetix [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^binlar [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^BlackWidow [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Bolt\ 0 [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:craftbot\@yahoo\.com [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^BOT\ for\ JCE [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^casper [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^checkprivacy [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw [NC,OR]
  • this is not even the beginning of hardening wordpress security May 11, 2016 at 10:29
  • You're right - the OP already took the beginning steps. The advice I offer includes some next steps for the OP to take. To disable directory browsing, for instance, is probably useful to the OP since the OP's website is currently allowing for directory browsing. Ya, the OP is asking to improve their PHP code, and my advice isn't about PHP -- but recommending the OP think outside the PHP layer. Given the broad nature of the question, I believe this is good advice. That said, yea, you're totally right, there're a lot of security things the OP should do and know about beyond just this. May 13, 2016 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.