pixel-d
11/29/2017 - 6:39 PM

Prevent Direct Access to Theme/Plugin Files

Mike Jolley - Keeping your shit secure: mikejolley.com/2013/08/13/keeping-your-shit-secure-whilst-developing-for-wordpress

Acunetix - Top Tips to Prevent a WordPress hack: acunetix.com/websitesecurity/preventing-wordpress-hack

restrict-direct-access.htaccess
content_copyfile_download
# Restrict direct access to PHP files from theme or plugin directories
# Place in root .htaccess file
 
# Restrict direct access to PHP files from plugin directories
 
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/file/to/exclude\.php
 
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/directory/to/exclude/
 
RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]
 
 
# Restrict direct access to PHP files from theme directories
 
RewriteCond %{REQUEST_URI} !^/wp-content/themes/file/to/exclude\.php
 
RewriteCond %{REQUEST_URI} !^/wp-content/themes/directory/to/exclude/
 
RewriteRule wp-content/themes/(.*\.php)$ - [R=404,L]
wp-exit-if-accessed-directly.php
content_copyfile_download
// Prevent Direct Access to Theme/Plugin files
// Place at the top of your theme or plugin files
 
if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly