4

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed directly via HTTP. For instance, http://MYSITE/blog/xmlrpc.php needs to remain directly accessible, but there's no reason why http://MYSITE/blog/wp-load.php shouldn't give a 404.

The question is: Where do I get a complete list of stock Wordpress .php files that can legitimately appear in URLs?

Also, I use mod_rewrite to remove the top-level index.php from all my published URLs -- does that mean I can block direct use of http://MYSITE/blog/index.php?whatever?

Improve this question
2
  • 1
    This is answered in a newer duplicate: wordpress.stackexchange.com/questions/415832/…
    – Ian Dunn
    Commented Aug 17, 2023 at 15:29
  • Confirming @IanDunn: your answer to that question is exactly what I was looking for 11 years ago (well, except that it doesn't address the final paragraph of this question, but that's minor).
    – zwol
    Commented Aug 17, 2023 at 15:54

1 Answer 1

Reset to default
-1

Correct me if I'm wrong, but far as I know, You don't access directly to any of the files, the apache user does. Meaning, the user browser talks to the server's httpd process which will get the file from the filesystem. So, i think that if you get a 404 on the browser when directly requesting a file, you will get the same 404 error when using the links on the wordpress pages.

I understand your point, I just don't know if it is possible.

About blocking requests based on the address, I think you should look at the specs of the .htaccess file. The Wordpress uses this file to config the permalinks.

Improve this answer
2
  • Right, any .php file that can appear in a hyperlink needs to be accessible via HTTP. But the vast majority of Wordpress's .php files are only used via require-type statements in the PHP code, which bypasses the web server's access permissions. Those files don't need to be valid HTTP GET destinations, and it might improve security to prevent them. I know how to write an .htaccess file that blocks access to files, I just need the list of .php files that shouldn't be denied.
    – zwol
    Commented Mar 6, 2012 at 15:56
  • 1
    Correcting you, because you're wrong. When you visit http://mysite.url/ you're really accessing http://mysite.url/index.php directly. Also in the admin, you access /wp-admin/index.php directly. When viewing post lists you access /wp-admin/edit.php directly. Etc ...
    – EAMann
    Commented Jan 20, 2013 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.