Secure Your Wordpress Plugins

19 January 2008 4 Comments

Secure Your WordPress Plugins

Tony Hung over on Deep Jive has an important post on securing your WordPress plugins directory. As it stands out of the box, the plugins directory is not protected and can easily be directory browsed. Considering you could be running an insecure plugin, having the directory open to browsing is not a great idea.

Luckily the fix is simple and only requires the addition of an index.html file in the folder.

Better safe than sorry…

Social Bookmarks:

4 Responses to “Secure Your WordPress Plugins”

Keebler 19 January 2008 at 1:47 pm #

That’s a decent sized hole in WP! I uploaded an index.html but that doesn’t help if you know the name of the files for the plugin. For example, if you know a specific plugin has a file foobar.php, you can just browse to /wp-content/plugins/foobar.php and you’ll quickly know if they have that plugin or not.
andreg 19 January 2008 at 2:45 pm #

Good point. I tend to think the core WordPress app is fairly secure and has a good track record of fixing holes. Plugins are always a little scary since anyone can write one and there is no requirement for good security practices.
bmattb 21 January 2008 at 1:28 pm #

Thanks for the tip, done and done.
Guinevere 22 January 2008 at 6:41 pm #

Same here, done! thanks for posting this…