1

A few years ago I was reading some blogs on how to harden your WP site, and one of the things suggested was to rename your install.php file so that someone couldn't re-install a new WP site over top of the current one.

It appears that when you update WP now the install.php file is put back. I've been trying to google whether this step is still necessary, but haven't found anything useful.

Any hard evidence this is still a good thing to implement? Or can I safely take this off my checklist of things to do.

Thanks.

Improve this question

1 Answer 1

Reset to default
0

I agree that this is a good step to take in hardening the site. I would not recommend interfering directly with the files from WordPress for the exact reason your describe: updates will overwrite it.

Two options I would recommend:

  • Use a hardening plug-in to help you do this
  • Add a rule to .htaccess to prevent people from accessing the file

In the wp-admin folder add this to .htaccess:

<Files install.php> Order Allow,Deny Deny from all </Files>

Improve this answer
2
  • Doing Option #2 breaks the site for me: Forbidden; You don't have permission to access /wp-admin/ on this server.
    – KVDD
    Commented Dec 6, 2016 at 23:58
  • I'll take a look at it later today. You might still consider a hardening plug-in like Securi.
    – Andy Jacobs
    Commented Dec 7, 2016 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.