I'm quite surprised/embarressed by file-structure, no htaccess protection

  • AB Smith

    (@ab-smith)


    11 years, 11 months ago

    Foreword: Sorry if I address a question that is already solved. If that’s so, then I just didn’t use the right search terms so far on wordpress.org.

    Hi!
    Just yesterday I installed the current WordPress version.
    It’s the first time I tried to use it, and I must say, I had very high expectiations and hopes.

    So far I used php-software that in it’s strucute is based on over 10 year old code, code that someone provided me with. (I doubt he wrote it all himslef, but there was no copyright or owner notice in it at all, so I can’t say if it’s based on some available software.)

    Fact is: All files in that software that were possibly behind .htaccess (user and password) protection were actually behind such .htaccess protection. (And the software consequently used all security measures in programming, that should be used – and often weren’t used by all the software I heard about in the last over 10 years.)

    Now – over ten years later – WordPress, one of the major players in CMS software, simply doesn’t have a suitable structure; a structure that would make it easily to deploy such .htaccess protection.

    I’m really embarressed and unpleasently surprised about that.

    So my questions are:
    1. Is there any suitable guide how to deploy that .htaccess security on a newly installed wordpress, without using plugins?
    2. Especially is there an official lis of files that could be put behind .htaccess protection, a list officially by wordpress.org?
    Some sort of determined files that will be stable for the coming versions in their function, and could so be build upon; files one could be sure about custom code and settings build upon them will work in the coming one year/six months, regardless which other regular strutcural official updates of wordpress will come.

    Sincerely
    AB Smith

Viewing 6 replies - 1 through 6 (of 6 total)
  • Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    11 years, 11 months ago

    As WordPress can run on web servers that aren’t Apache and don’t use or honor .htaccess files, I’m embarrassed that you’re embarrassed. 😉

    WordPress uses the .htaccess file as the method to accomplish pretty permalinks.

    For general WordPress hardening and security practices these are good reads.

    Hardening WordPress
    http://www.studiopress.com/tips/wordpress-site-security.htm

    For securing your Apache web server installation give this link a try.

    Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    🏳️‍🌈 Advisor and Activist

    11 years, 11 months ago

    Some sort of determined files that will be stable for the coming versions in their function, and could so be build upon; files one could be sure about custom code and settings build upon them will work in the coming one year/six months, regardless which other regular strutcural official updates of wordpress will come.

    No. Not really. Which is why we suggest you use the available functions, hooks, and such to expand the code 🙂 Those will stick around for a long time.

    sumonht1990

    (@sumonht1990)

    11 years, 11 months ago

    Thank you for sharing.

    Thread Starter AB Smith

    (@ab-smith)

    11 years, 11 months ago

    I have now used a <Filematch …> and “require user …” statement for all .php files in the .htaccess
    In one of the links given above it says, that it could break some functionality if putting the wp-admin directory behind .htaccess protection, so I assume this could happen with my <Filematch> statement, too. But as long as it does work for me, it’s fine.

    Thank you for the infos and links!

    Greetings
    AB Smith

    P.S. The only problem I could theoretically see, would be some code that demands a “false” (=negating) return value from some protected .php function (while not yet logged in as the ‘required user’), as it else would assume “true” (=confirmed).

    Thread Starter AB Smith

    (@ab-smith)

    11 years, 11 months ago

    Sadly I just saw that protecting all php files (except index in the root directory of the domain) does already break wordpress.
    I would have bet that it worked yesterday.

    So maybe you could make a list of php files that could be protected without breaking the system.

    Greetings
    AB Smith

    Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    🏳️‍🌈 Advisor and Activist

    11 years, 11 months ago

    So maybe you could make a list of php files that could be protected without breaking the system.

    The only file that should be needing protection is wp-config.php (and .htaccess, really). You could also protect the wp-admin folder and wp-includes if you want, but there’s less of a pressing need. So long as your password is strong, your server is secure, you’re pretty safe.

    Read this:
    http://codex.wordpress.org/Hardening_WordPress

    It has advice on how to secure things correctly.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘I'm quite surprised/embarressed by file-structure, no htaccess protection’ is closed to new replies.