17

WordPress itself, in the wp-content folder, includes an empty PHP file which looks like this.

<?php
// Silence is golden.
?>

Should plugins include an empty file like this as well to stop folks view viewing the contents of a directory? What about additional folders in themes -- like an includes directory?

Improve this question
1
  • 1
    yes, it's probably a good idea. Never understood why WP doesn't have Options –Indexes in the bundled htaccess, so these files wouldn't be necessary...
    – onetrickpony
    Commented Mar 13, 2012 at 1:45

4 Answers 4

Reset to default
20

No, they should not. If a plugin has vulnerabilities just because someone might see its directory structure it is broken. These bugs should be fixed.
Security through obscurity is a bug for itself.

It’s up to the site owner to allow or forbid directory browsing.

A second issue is performance: WordPress scans all PHP files in a plugin’s root directory to find plugin headers. This allows you to have multiple plugins under the same directory, eg /wp-content/plugins/wpse-examples/.

It also means that unused PHP files in that directory are wasting time and memory when WordPress is searching for plugins. One file will not do much harm, but imagine this is getting a common practice. You are creating a real problem in an attempt to fix a fictional.

Improve this answer
2
  • 3
    "Its up to the site owner to allow or forbid directory browsing." That's probably the key point.
    – chrisguitarguy
    Commented Mar 13, 2012 at 1:49
  • and my main question is, why not the main plugin files is not written in index.php? that could be optimal workaround
    – T.Todua
    Commented Apr 15, 2018 at 19:31
12

I am going to say YES. Security through obscurity works if you're more obscure then your neighbors :) (joking but there is some truth to that).

The reality is that the bots/scanners now compile the plugin lists right off wordpress.org and crawl the plugin url's directly, fingerprinting versions for known exploits and keeping the info in a database for reference.

So which one would you rather have, a bot not being able to gather info on your install, or leaving it up to the plugin author to make sure you're secure. How about both.

ps. On a side note there were 186 reported exploits from wordpress.org plugins last year .(*reported..).

Improve this answer
7
  • 1
    Exploit scanners do not test if the plugin exists. They try to run the exploit during the first request. An empty index.php would not protect anything, you would just get a false sense of security.
    – fuxia ♦
    Commented Mar 13, 2012 at 2:16
  • But they do, wp-scan (one of many) fingerprints over 2200 plugins for example, and uses some decent fingerprinting to detect versions (file size, file additions, etc).
    – Wyck
    Commented Mar 13, 2012 at 2:20
  • I’ve cleaned up dozens of hacked WordPress sites. Almost always the first request was a real attack. That’s just reasonable: Why wasting time with a detailed scan if you can test the vulnerability in the first request? Track your 404s to see it. :)
    – fuxia ♦
    Commented Mar 13, 2012 at 2:25
  • 1
    I agree, this should be up to the end user and not the author. But I don't think it hurts either. I just wanted to add a counter-point since you said "no".
    – Wyck
    Commented Mar 13, 2012 at 2:36
  • 1
    marked this one as accepted because of the comment debate!
    – chrisguitarguy
    Commented Mar 22, 2012 at 2:49
1

Since WordPress core does this is makes sense for plugins to follow suit. While all of this can be protected with various server side settings it doesn't hurt to have a default (probably why WordPress core does it).

Improve this answer
1

As fuxia pointed out, there is a performance drawback in having an extra .php file that WordPress to scan for plugins. An index.html would probably be a better option. Of course, the best option would be to forbid directory browsing through the web server.

And also, security through obscurity is no good.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.