WordPress Directory Listing Risk
A large number of WordPress directories do not have an index file. This is particularly dangerous in case of the plugins directory. If your server allows directory listings, a potential attacker may see which plugins you have installed. Most plugins have security vulnerabilities. One way of fixing this is by adding the following line to the .htaccess file in the Web server’s root (htdocs):
Options -Indexes
Another approach is to put an index file in each folder on your site that does not already have one. You can have this index file redirect the visitor back to the main page of your site. Create the /wp-content/index.html with 644 permissions and the following content:
<meta HTTP-EQUIV="REFRESH" content="0; url=http://www.yourdomain.com">
Now you can create a link in all directories under wp-content pointing to this index file. Thus, if you need to change this file in the future, you only need to modify one file. The script below will help you create the links from the wp-content directory:
#!/bin/ksh cd ${HOME}/public_html/wp-content if [ ! -f index.html ] then echo '<meta HTTP-EQUIV="REFRESH" content="0; url=http://www.yourdomain.com">' > index.html chmod 644 index.html fi find . -type d | while read dir do if [ `ls "${dir}" | egrep -c "index.html|index.htm"` -eq 0 ] then ln -s ${HOME}/public_html/wp-content/index.html "${dir}"/index.html fi done
Popularity: 3% [?]
Related posts:
