I am tweaking WordPress to understand it better, play with it. For personal purposes.

But loading custom files from the /wp-includes folder won't work.

I tried to add a info.php file under /wp-includes containing phpinfo() and when I try to access it in the browser via example.com/wp-includes/info.php, the server returns error 503.

The folder permissions are set to 775 and the file permissions to 644.

Important note: If I rename the wp-includes folder to something else, like wp-include, then it works!

I contacted the hosting support to ask if they added some kind of protection but they say they did not, they say: "It's how WordPress is designed, it doesn't allow to modify files".

There isn't any .htaccess file in that folder. And the root htaccess file contains the following:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

# Protect WP Config
<Files wp-config.php>
    order allow,deny
    deny from all

How can I get to the reason for that 503 error. A PHP file with just plain text won't work either.

  • 503 sounds like the wrong error. Is there anything in the Apache error log? Can you see the access in the access log - there's no reverse proxy or similar in front of your site that might be intercepting this instead?
    – Rup
    Jun 22, 2021 at 9:23
  • 1
    why are you running it from within the wp-includes directory? It could be possible that your host is preventing the execution of scripts called directly from that directory since that basically never happens under normal circumstances. Does it run okay from within the wp-admin directory?
    – Paul G.
    Jun 22, 2021 at 9:32
  • @Rup Thanks for your attention. The Apache error log is empty. I will ask about the proxy. Jun 22, 2021 at 9:40
  • @PaulG. Thanks for your attention! Yes, it works from other folders including wp-admin and the root folder. I am running it from there because I am tewaking original WP core files. I know it's not the point of WP but I am doing it :) Jun 22, 2021 at 9:42
  • 4
    you're not supposed to load files directly from the wp-includes folder, and modifying core itself is a major anti-pattern. If your goal is to learn, filters and hooks can let you do that from the plugin and theme folders
    – Tom J Nowell
    Jun 22, 2021 at 9:56

1 Answer 1


Important note: If I rename the wp-includes folder to something else, like wp-include, then it works!

Nothing in WordPress specifically prevents what you did, but, what you did would be considered a security breach by most security regimes. It would also be destroyed the moment an automatic update occurred.

So your request could have been blocked by:

  • firewalls
  • security plugins
  • Higher level Apache configs
  • data centre level security
  • PHP security extensions
  • CDN rules

And many other things.

wp-includes does not contain PHP files that can be directly accessed from the browser, so it's a safe assumption that if such a file is in that folder, it must be malicious.

Likewise, a common security feature is to prevent execution of PHP in the uploads folder.

If you are looking for a place to put a file that contains phpinfo(), wp-includes is not the place to put it. You could use a file in the root folder instead, or a page/theme template. You could also create a new sub-folder for your own testing of generic PHP files.

Unlike some other frameworks and CMS, WordPress is meant to be modified using the plugin/theme/hooks/filters system, with some more obscure mechanisms such as drop ins. The one thing that's consistent is that you don't modify the files of a standard WordPress core folder.

If you want to contribute to core, you should instead be using the develop/source version of WordPress from GitHub combined with a local dev environment:


  • Thanks Tom, this is a great answer to the question. Jun 27, 2021 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.