Htaccess Block all php file in certain directories

Question

I am trying to secure my wordpress site through htaccess - By blocking php files from folders.

Example:

Deny all php files in wp-content
Allow php files in in wp-admin and wp-includes
On home directory, allow index.php and allow all files with wp and deny all.

So Far:

Deny wp-config.php

<files wp-config.php>
order allow,deny
deny from all
</files>

Run only certain files (but i cant get directory to work on this level)

Order deny,allow
Deny from all
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>

anubhava · Accepted Answer · 2014-09-22 20:10:58Z

2

You cannot match directories using Files directive.

Have these 2 rules as your very first rules in main WP .htaccess:

RewriteEngine On

RewriteRule ^/?wp-content/.+?\.php - [NC,F]

RewriteCond %{REQUEST_URI} !^/(index|wp.+?)\.php [NC]
RewriteRule ^/?[^./]+\.php - [NC,F]

Don't forget to remove all the Files blocks.

edited Sep 22, 2014 at 20:10

answered Sep 22, 2014 at 20:05

anubhava

790k67 gold badges603 silver badges671 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

jagmitg Over a year ago

Would u recommend i do this at the httpd.conf

anubhava Over a year ago

If you already have a WO .htaccess and might as well do it there. Alternatively you can do this in httpd.conf (see updated rules that will work in both places)

jagmitg Over a year ago

I want to be able to redirect it to the homepage if file is opened, anyway of doing that? code so far RewriteRule ^/?wp-content/.+?\.php$ / [NC,F] (want to be able to do it dynamically without entering in the url

anubhava Over a year ago

You can do: RewriteRule ^/?wp-content/.+?\.php / [NC,L,R=302] for that.

Fernando Torres Over a year ago

this answer doesn't helped me at all

|

Collectives™ on Stack Overflow

Htaccess Block all php file in certain directories

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related