A few years ago I was reading some blogs on how to harden your WP site, and one of the things suggested was to rename your install.php file so that someone couldn't re-install a new WP site over top of the current one.

It appears that when you update WP now the install.php file is put back. I've been trying to google whether this step is still necessary, but haven't found anything useful.

Any hard evidence this is still a good thing to implement? Or can I safely take this off my checklist of things to do.


1 Answer 1


I agree that this is a good step to take in hardening the site. I would not recommend interfering directly with the files from WordPress for the exact reason your describe: updates will overwrite it.

Two options I would recommend:

  • Use a hardening plug-in to help you do this
  • Add a rule to .htaccess to prevent people from accessing the file

In the wp-admin folder add this to .htaccess:

<Files install.php> Order Allow,Deny Deny from all </Files>

  • Doing Option #2 breaks the site for me: Forbidden; You don't have permission to access /wp-admin/ on this server.
    – KVDD
    Dec 6, 2016 at 23:58
  • I'll take a look at it later today. You might still consider a hardening plug-in like Securi. Dec 7, 2016 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.