Many php files in a WordPress installation are only used through require() or include(). Leaving them exposed to direct web access may increase security risks. Files such as wp-config.php has no need to be called directly from the web. For this reason it is ok to add a RewriteRule to the .htaccess file, redirecting requests for wp-config.php to a 404 page, for example: RewriteRule ^wp-config.php /error404.htm [L,R=301,NE]

My question, for those of you that have already checked and tested which files have no reason to be accessed directly form the web, is: is there a list of php files that is safe to "protect" with a RewriteRule? By your experience, are there downside doing so?

I did search StackExchange and the web, and found very little about it. This question asked 12 years ago, has not a good answer yet: Which of WordPress's .php files need to be directly accessible via HTTP?

  • In what way is accessing wp-config.php a security risk? It's entirely PHP, exposes nothing on the front-end, and accepts no query strings or posted data.
    – vancoder
    May 5, 2023 at 21:29
  • @vancoder you are right, should not be a direct security risk, until it is tho. Many bots scan IP addresses/domains to get a list of wordpress sites, in case a vulnerability comes up and they can attack them, so giving 404 to files that in other cases would be exposed, can help mitigare attacks, or at least attacks attempts.
    – capodieci
    May 7, 2023 at 22:35

1 Answer 1


Rather than asking which ones don't need direct access (a blocklist), I think it's better to ask which ones do need it (a safelist). That way everything is blocked by default, so new files aren't accessible until you manually unblock them.

I've seen a site use this safelist for a long time with no problems:

# wp-admin

# wp-includes

# root

You'll need to add any plugins/theme files that need direct access, but that should be pretty rare. Every once in awhile Core adds a new file like site-health.php that needs to be added, but that'll be obvious because users will report that a link in wp-admin isn't working.

FWIW, I don't think this has a ton of security benefit, and there are many things you should do long before it. It doesn't hurt, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.