I'm pretty sure the answer is "No, they can't see functions.php or any theme php files" but I can't find an answer anywhere.


It's always difficult to prove that something isn't there, like the famous teapot circling the earth. So you'll have to trust me that the WordPress source code does not have any functions that might display its own php files.

That said, it would be easy to write such code. So, if you install plugins of unknown origin or do otherwise ill advised things to your site, you could still expose functions.php.

Not strictly speaking a WordPress issue would be your server's security. If you set file permissions wrongly (in .htaccess for instance), you could make all your files visible from the outside.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.