0

Someone at stackoverflow suggested I should deny access to the two files by doing below in .htaccess.

<files ~ "^.*\.([Hh][Tt][Aa])">

order allow,deny

deny from all

satisfy all

</files>

<files wp-config.php>

order allow,deny

deny from all

</files>

The problem is it screwed up my installation of W3 Total Cache plugin cos it needs to write to those files.

Since my htaccess and wp-config were hacked a few times, what is the best way to protect these files?

4
  • You need to take into account the pros & cons for both blocking and non-blocking. Do the benefits gained using W3 Total Cache outweigh the high potential for hacking attempts? If you were hacked, how quickly can you recover? Personally I'd consider using another caching plugin or perhaps set up Nginx & Apache in a caching format. Mar 5 '20 at 21:40
  • Do you add the similar codes above in your htaccess?
    – cilapo1541
    Mar 5 '20 at 21:47
  • 1
    "The problem is it screwed up my installation of W3 Total Cache plugin cos it needs to write to those files." - but this config just stops Apache serving these files to the world. You'd have to set file ownership or permissions to stop WordPress writing to them.
    – Rup
    Mar 6 '20 at 0:17
  • .htaccess files are often blocked already in the server config - this isn't something you should need to do in .htaccess itself anyway. This is also using Apache 2.2 directives. You are more likely to be on Apache 2.4.
    – MrWhite
    Mar 6 '20 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.