I installed latest WordPress 3.5 in my CentOS server. When I tried accessing http://example.com/wp-includes/, I received a listing of the directory: (Index of wp-includes).

I added the following code at the top of .htaccess file, and it fixed the issue:

Options -Indexes
IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

My problem

When I try accessing PHP files in wp-includes and wp-content using a web-browser (for example: http://example.com/wp-includes/class-smtp.php), it shows a blank screen. I think it should show "Permission denied" or something like this. Am I correct?

How can I achieve this? I'm concerned if my website is vulnerable to attacks. I am already aware of the Hardening WordPress article.

Here are my directory and file permissions:

  • wp-admin: 755
  • wp-content: 755
  • wp-includes: 755
  • Files have permission 644
  • 3
    Server response has nothing to do with security, what can you do with a blank screen and only read access, nothing.
    – Wyck
    Commented Dec 18, 2012 at 23:30

2 Answers 2


The PHP files in the wp-includes directory will do nothing when accessed directly. They are designed to be include()'d in an existing PHP script, such as on the front-end or in the dashboard.

Your Options -Indexes entry in the .htaccess file simply prevents a list of the files in a directory when no index.php is present. It's good practice to use this on a live server. I'm not entirely sure what the second line does; you should most likely remove it.

If you're especially concerned about people attacking your server, you can prevent access to the wp-includes directory completely. To do this, create a .htaccess file inside the wp-includes folder with the following content:

Deny from all

If you want to protect your WordPress installation, one thing that I always do when I install WordPress is to protect my wp-admin folder (your login page). What I do is I create .htaccess file in wp-admin and allow only certain IPs to access this folder. I think there's some info on WordPress login page here: htaccess redirect

Also who is your host? Did you set this server up yourself? You should not be seing your index of wp-includes after you install WordPress. It has never happened to me before. :/

  • The login page (wp-login.php) isn't part of wp-admin
    – shea
    Commented Jan 17, 2013 at 6:28
  • Yes you are correct. I should have explained this a little better. You can still access your login page by going to domain.com/wp-login.php however, if you do allow only certain IPs to access the wp-admin folder, the ones that are not on the list will get a 403 , permission denied error.
    – beacon
    Commented Jan 17, 2013 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.