curl -I http://ma.tt/blog/wp-config.php
200 OK

The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by Google)

Also, for file such as readme.html, it should be hidden as it disclose your wordpress version, e.g. http://ma.tt/blog/readme.html

So, currently I have selected several files and block in the web server level, e.g.


But as there are so many files, especially under the wp-admin and wp-include folders, are there any better way to do it to improve security?

  • How exactly are these files useless? Without the core files, WP wouldn't functions. wp-config.php, for example, is how you connect to your database.
    – David Gard
    Nov 22, 2012 at 15:48
  • 1
    I think OP wants to show 404 page if they are being opened directly from a browser Nov 22, 2012 at 16:08
  • Sorry for my bad title, I have updated the description.
    – Yoga
    Nov 23, 2012 at 18:02
  • 1
    Nice that you offer a bounty, but still don't tell what your exact goal is :P
    – kaiser
    Nov 26, 2012 at 17:58
  • 2
    Preventing the files from being accessed directly and attempting to hide your WordPress version are not real security measures. They don't improve security one little bit. So if you're asking how to do it to improve security specifically, then there is no real answer to your question because doing those doesn't "improve security" in any way whatsoever.
    – Otto
    Nov 27, 2012 at 21:27

3 Answers 3


I wouldn't bother with the readme file as probably no hacker bothers to check your WP version before trying to hack into the site. Will not bother with anything in /wp-includes and /wp-admin because I trust the core team to make that code secure in the default installation, and those file don't contain any information which is specific to my site.

The files to protect are wp-config.php, because it contains DB access details and the /wp-content directory because theme and plugins developers are not very good at security. for wp-config just deny access in your .htaccess

<files wp-config.php>
order allow,deny
deny from all

for /wp-content/plugins and /wp-content/theme deny access for anything which is not animage,js or css file by adding an .htaccess there with the following content. If a plugin or theme does not work with this configuration they probably don't follow WP coding guidelines and it might be better not to use them.

<Files ^(*.jpeg|*.jpg|*.png|*.gif|*.js|*.css)>
   order deny,allow
   deny from all

for /wp-content/uploads you can't realy deny access as you don't know which type of files will be uploaded there, so the best thing to do there is to simply not to allow the execution of php,perl,pyton at that directories and serve them as plain text with the following rules

<FilesMatch "\.(php|pl|py|jsp|asp|htm|shtml|sh|cgi)$">
ForceType text/plain

Once you are satisfied, you should probably combine everything to one .htaccess at root for better performance

  • +1, nice write-up, although the correct answer is what Otto writes in the Q's comments: "there is no real answer" ;)
    – brasofilo
    Dec 2, 2012 at 2:54
  • @brasofilo, the reason I wrote the answer was because I disagreed with otto. In the specific context of the question, preventing execution of scripts which were uploaded to the server is important security measure as even if there is a security breach through a plugin or insecure shared server, the uploads directory is the easiest target for the hacker to install his code and breach further into your site. So sure, those steps are far from being the alpha and omega of WordPress security but your security is better if you implement them. Dec 2, 2012 at 14:41
  • 1. The first thing a hacker checks is the version. 2. Never trust anyone, don't assume the core is secure. 3. You can protect wp-config by moving outside the web root. The other suggestions are moot.
    – Wyck
    Dec 2, 2012 at 17:50
  • @Wyck, 1. then you never need to upgrade just change your generator string and readme file. 2. if core is not secure then WordPress should not be used as CMS for anything that is really important to you. 3. wordpress.stackexchange.com/questions/58391/… and codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php IMO both methods are basically the same, but moving the file requires more mental work. Dec 2, 2012 at 19:44
  • 1
    @CraigHicks, in general the index.php files are there to prevent directory listing "attacks" and are not being executed or included in any context Mar 1, 2018 at 19:12

First a correction, if you block the files under wp-admin, you won't be able to use the wordpress admin panel. Though you can block the files under "wp-admin/includes" folder

Now the solution:-
You don't need to type all the names, you can use regular expressions to block a pattern of files for ex. it's easy to write a regular expression to block all the files which reside in the wp-includes folder.

If you don't have other files in the same wordpress directory, then instead of blocking specific files, you can go through to the whitelist approach i.e. allow only specific files. Specifically you'll allow only the files which reside inside the wp-admin & wp-content folder & of course the main wordpress file(index.php)

If your themes & plugins don't use any dynamically generated files, you can just block all php files from direct access except those in wp-admin & index.php

Whatever approach you take, just remember to only block php files & not anything else, otherwise the browser won't be able to load all the admin panel's CSS & the javascript.

  • Blocking of wp-include is not a solution as it will block script such as jQuery (wp-includes/js/jquery/jquery.js)
    – Yoga
    Nov 23, 2012 at 18:11
  • 1
    The last paragraph clearly says to block only php files & nothing else Nov 23, 2012 at 18:15

Short Answer:

You are wasting time - you won't be able to increase security. Read excellent answer:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.