WordPress directory protection?

ShadeDream

BANNED

Nov 27, 2008

2,296

5,536

• Apr 5, 2010

• #1

I'm not a programmer hence I'm unsure if this is going to be an issue but basically when you add plugins to a WordPress installation, each plugin directory is accessible by anyone who browses to it. For example, if I upload the platinum seo pack plugin into my WordPress plugins directory, anyone can access the folder for the platinum seo pack plugin in their browser. To prevent this from happening I created a blank index.php file in each plugin folder so that no folders would be accessible through the web browser. I'm wondering if this index.php could cause any errors or interfere with the plugins in any way?

 

Last edited: Apr 5, 2010

ShadeDream

BANNED

Nov 27, 2008

2,296

5,536

• Apr 6, 2010
• Thread Starter Thread Starter

• #2

Would anyone advise me on this?

 

nufaman

Elite Member

May 29, 2009

1,870

1,345

• Apr 6, 2010

• #3

WHat permissions does your plugins folder have?

I just tried to access any plugin folder and it won't let me in my browser

 

gregstereo

Elite Member

Jr. VIP

Oct 5, 2009

2,400

1,227

• Apr 6, 2010

• #4

Use robot files to exclude your plugin directories. For example:

Code:

User-agent: *
Disallow: /wp-content/cache/
Disallow: /wp-content/themes/
Disallow: /wp-content/plugins/
Disallow: /wp-admin/
Disallow: /wp-includes/
Disallow: /wp-login.php

will keep both surfers and bots from those folders. Guh-oogle sometimes disregards robot files, but hey it's guh-oogle what are you gonna do? robot files will at least thwart the casual surfer.

 

nufaman

Elite Member

May 29, 2009

1,870

1,345

• Apr 6, 2010

• #5

Robots.txt has nothing to do with someone being able to visit a folder, it is just to avoid getting the contents crawled by the bots

 

tami6699

Regular Member

Oct 8, 2009

470

741

• Apr 6, 2010

• #6

Code:

Order deny,allow
Deny from all
Allow from <ip>

.htaccess

 

gregstereo

Elite Member

Jr. VIP

Oct 5, 2009

2,400

1,227

• Apr 6, 2010

• #7

nufaman said:

Robots.txt has nothing to do with someone being able to visit a folder, it is just to avoid getting the contents crawled by the bots

Click to expand...

yeah crap, right, sorry....I really need to have more coffee before I try posting technical info

 

J

jacobus

Newbie

May 15, 2008

33

28

• Apr 6, 2010

• #8

a blank 'index.php' or 'index.html' works just fine.

 

ShadeDream

BANNED

Nov 27, 2008

2,296

5,536

• Apr 6, 2010
• Thread Starter Thread Starter

• #9

nufaman said:

WHat permissions does your plugins folder have?

I just tried to access any plugin folder and it won't let me in my browser

Click to expand...

By default it's 755. So if I try accessing wp-content/plugins/platinum-seo-pack, the platinum seo pack folder shows all the files in it. So I just created a blank index.html file in each plugin folder. I was just wondering if that?s the best thing to do. I don't think chmod has anything to do with this.

jacobus said:

a blank 'index.php' or 'index.html' works just fine.

Click to expand...

Oh, okay. I guess that's the answer I was looking for. Thanks.

 

A

al8xandru

Newbie

Mar 23, 2010

14

2

• Apr 6, 2010

• #10

thats what i use to protect my templates from being access directly

Code:

<Files *.tpl>
order allow,deny
deny from all
</Files>

and i use this

Code:

Options -Indexes

not to allow directory listings.
Ohh btw this are for .htaccess

 

tami6699

Regular Member

Oct 8, 2009

470

741

• Apr 7, 2010

• #11

The .htaccess solution is much more better and also better/easier for administration (you only have to put the /plugin, the deny, and you don't have to remember to put in all /plugin/xyzplugin your empty index.php inside)...

 

ShadeDream

BANNED

Nov 27, 2008

2,296

5,536

• Apr 14, 2010
• Thread Starter Thread Starter

• #12

I ended up staying with a blank index.php file. Using .htaccess deny from all, will screw up some plugins and if you put this in your themes folder, it will screw up your whole design and css because it denies access from all the files stored in the themes/plugins directory or wherever you place the .htaccess file.

 

M

mointernet

Regular Member

Apr 21, 2008

444

217

• Apr 16, 2010

• #13

instead of putting in a blank index.php, have it redirect to the main homepage of your site or anywhere else would be a better choice.

Code:

<?php
header("location: http://yourhomepage.com");
?>

put it in your plugins, themes and wp-content directories, people getting to it will be brought back to your homepage or anywhere else you specify.