Prevent/block directory listing in wordpress with this .htaccess file trick.In wordpress, by default, your themes and plugins directory can be viewed via the web browser.This could be dangerous, if hackers get to know your themes and plugins.
Disadvantages of directory listing:
- If hackers get to know the plugins and themes used on your blog, they could try to exploit bugs in those themes and plugins to hack your blog.Note that wordpress makes security release (wordpress 2.6.2 is the latest) for the wordpress base code and not for security holes in your wordpress themes/plugins
- People can find out the files and folders, that you might have saved on your server and not intended for the general readers.
You can check whether your plugin and theme folders are viewable via the web brower, by entering http://your-wordpress-home/wp-content/plugins/ or http://your-wordpress-home/wp-content/themes/. Replace “your-wordpress-home” in the above url with those of your wordpress home.For example my wordpress home is techblissonline.com.
How to prevent directory listing in wordpress?
You can prevent/block directory listing in wordpress by two methods:
- Upload a blank index.html file to the directories.For example, you could prevent directory listing of your themes folder by uploading a blank index.html file to the themes folder. i.e. http://your-wordpress-home/wp-content/themes/. However this would involve uploading blank index.html files to every directory for which you want to prevent directory listing. 🙁
The other easier option to prevent directory listing, is
- to edit the .htaccess file, that lives in your WordPress root directory and add the following lines to the top:
# Prevents directory listing
Isn’t that easy? Go edit the .htaccess file in your wordpress root and add the option to prevent directory listing in wordpress.