0

This question would appear similar to Deny php execution in /wp-includes - using .htaccess in /wp-includes VS root folder - but is different in that that question asserts the questioner has already determined they want to deny access.

I'm trying to clamp down on "drive by hacking" on my generic wordpress hosting server - ie I don't control what plugins can be run. (I noticed a site I am very familiar with getting slammed, and discovered it was something dodgy looking at files in this directory - and I thus know this useage was not legitimate). I can easily whip something up to block php access to this directory - and my looking at the server logs would imply this is likely a good idea - but are there any gotchas I need to be aware of, or legitimate reasons why php files might be called from the web browser for anything which is under the wp-includes directory?

4
  • I have a more constructive comment than the deleted last ;-) the directory wp-includes is part off the wordpress core then if it might be a risk of security, the core team would have secure it. then if you use wordpress in a standard way (without editing core files and juste adding themes and plugins) there is nothing to do in this directory. read the comments of the question you quote, they speak also about that.
    – mmm
    Commented Jul 14 at 9:36
  • 1
    This issue already reported on WordPressCore Trac : core.trac.wordpress.org/ticket/61314#ticket Commented Jul 15 at 5:05
  • @NarendraSishodiya Thank you - that comment link pretty well implies the answer!
    – davidgo
    Commented Jul 15 at 7:05
  • Glad to know, this should help you out. Commented Jul 15 at 7:07

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.