Title: Securing wp-includes
Last modified: April 3, 2021

---

# Securing wp-includes

 *  Resolved [Sergey](https://wordpress.org/support/users/sergeybaev/)
 * (@sergeybaev)
 * [5 years, 3 months ago](https://wordpress.org/support/topic/securing-wp-includes-2/)
 * Hello!
    There is an article about hardening WordPress ([https://wordpress.org/support/article/hardening-wordpress/#securing-wp-includes](https://wordpress.org/support/article/hardening-wordpress/#securing-wp-includes)).
 * The article recommends adding some code to the .htaccess file outside the “# 
   BEGIN WordPress” to secure “wp-includes”:
 *     ```
       # Block the include-only files.
       <IfModule mod_rewrite.c>
       RewriteEngine On
       RewriteBase /
       RewriteRule ^wp-admin/includes/ - [F,L]
       RewriteRule !^wp-includes/ - [S=3]
       RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
       RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
       RewriteRule ^wp-includes/theme-compat/ - [F,L]
       </IfModule>
   
       # BEGIN WordPress
       ```
   
 * In the code that is automatically generated by your plugin I did not find these
   lines of code.
    Do I have to add this code manually in the .htaccess file after
   the code generated by your plugin? For example, like this:
 *     ```
       # BEGIN All In One WP Security
       ...some autogenerated code by your plugin
       # END All In One WP Security
   
       # Block the include-only files.
       ...manually adding the code from the article above to secure wp-includes
   
       # BEGIN WordPress
       ...standart wordpress code
       # END WordPress
       ```
   
 * Or does your plugin already include securing of the “wp-includes” folder with
   some other equivalent way and I do not have to add the code manually?
 * Thank you
    -  This topic was modified 5 years, 3 months ago by [Sergey](https://wordpress.org/support/users/sergeybaev/).

Viewing 4 replies - 1 through 4 (of 4 total)

 *  Plugin Contributor [mbrsolution](https://wordpress.org/support/users/mbrsolution/)
 * (@mbrsolution)
 * [5 years, 3 months ago](https://wordpress.org/support/topic/securing-wp-includes-2/#post-14274591)
 * Hi, unfortunately our plugin does not include the security code you mentioned
   above.
 * Kind regards
 *  Thread Starter [Sergey](https://wordpress.org/support/users/sergeybaev/)
 * (@sergeybaev)
 * [5 years, 3 months ago](https://wordpress.org/support/topic/securing-wp-includes-2/#post-14274744)
 * Thank you for your answer!
    I think it would be nice if in the future you consider
   including the ability to add this secure code in plugin settings, if you think
   it’s necessary.
 * For example, add a new feature with a checkbox to the “File system protection”
   section with explanations of the usefulness of this code and warnings that this
   code won’t work well on Multisite (and possibly with other warnings, if any).
 * Anyway, I think your plugin is great and very useful!
    Thank you so much for 
   your work!
    -  This reply was modified 5 years, 3 months ago by [Sergey](https://wordpress.org/support/users/sergeybaev/).
 *  Plugin Contributor [mbrsolution](https://wordpress.org/support/users/mbrsolution/)
 * (@mbrsolution)
 * [5 years, 3 months ago](https://wordpress.org/support/topic/securing-wp-includes-2/#post-14274801)
 * I have submitted your request to the developers to investigate further.
 * Kind regards
 *  Thread Starter [Sergey](https://wordpress.org/support/users/sergeybaev/)
 * (@sergeybaev)
 * [5 years, 3 months ago](https://wordpress.org/support/topic/securing-wp-includes-2/#post-14274804)
 * Thank you

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Securing wp-includes’ is closed to new replies.

 * ![](https://ps.w.org/all-in-one-wp-security-and-firewall/assets/icon-256x256.
   png?rev=2798307)
 * [All-In-One Security (AIOS) – Security and Firewall](https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/all-in-one-wp-security-and-firewall/)
 * [Active Topics](https://wordpress.org/support/plugin/all-in-one-wp-security-and-firewall/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/all-in-one-wp-security-and-firewall/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/all-in-one-wp-security-and-firewall/reviews/)

 * 4 replies
 * 2 participants
 * Last reply from: [Sergey](https://wordpress.org/support/users/sergeybaev/)
 * Last activity: [5 years, 3 months ago](https://wordpress.org/support/topic/securing-wp-includes-2/#post-14274804)
 * Status: resolved