{"id":1466,"date":"2018-04-25T20:03:15","date_gmt":"2018-04-25T20:03:15","guid":{"rendered":"https:\/\/jdthomson.com\/?p=1466"},"modified":"2022-07-11T10:17:44","modified_gmt":"2022-07-11T10:17:44","slug":"leaving-wordpress-files-exposed","status":"publish","type":"post","link":"https:\/\/jdthomson.com\/leaving-wordpress-files-exposed\/","title":{"rendered":"Are you Leaving your WordPress Files Exposed?"},"content":{"rendered":"<div class=\"has-content-area\" data-url=\"https:\/\/www.mphcreative.com\/?p=6704\" data-title=\"Are you Leaving your WordPress Files Exposed?\">\n<p>Are you using WordPress, there may be an issue you don\u2019t know anything about that\u2019s affecting the security of your uploaded files. Just because you have it set up so that only people who can access have to go through an opt-in process, it doesn\u2019t always mean that the public can\u2019t access them.<\/p>\n<h2>Lets check if you have this issue.<\/h2>\n<p>go to your site\u2019s upload directory.<br \/>\nFor example,<\/p>\n<pre><code>WWW.yoursite.com\/wp-content\/uploads. \r\n<\/code><\/pre>\n<p>You may see your themes and plugins, numerous folders and lots of images. Take a closer look, and you will be able to see that file you uploaded as part of your product that you are selling.<\/p>\n<p>What this means that anyone with a little bit of knowledge can easily access and download any or all of your files for free.<\/p>\n<p>It\u2019s not hard.<\/p>\n<p>If you test this directory URL on other WordPress sites that you knew. Some had their upload directory are hidden, but others may not.<\/p>\n<h2>How To Hide a WordPress Upload Directory?<\/h2>\n<p>There are two methods you can use.<\/p>\n<h3>Plugin<\/h3>\n<p>Using Security Plugins can make it easy to restrict WordPress directory browsing so that no one can view your the uploads file.<\/p>\n<p>The two plugins I Recommend are:<\/p>\n<ul>\n<li>Sucuri Security Plugin<\/li>\n<li>Wordfence Plugin<\/li>\n<\/ul>\n<h3>Manually<\/h3>\n<p>You can create a blank index.html or index.php file and then upload it to your WordPress wp-content\/uploads directory. This method will successfully hide your uploads directory from the public.<\/p>\n<p>Another way is to modify your .htaccess file which can be found in the root directory. This method can be a bit more complicated, but it will protect your data from nosey people or hackers.<\/p>\n<h3>Hide Wp-config.php<\/h3>\n<p>The Wp-config.php file stores information about your WordPress database &amp; site. You don\u2019t want anyone getting that information. This file can be hidden by modifying the .htaccess file in the root directory<\/p>\n<p><strong>Add the following to your .htaccess file:<\/strong><\/p>\n<pre><code>&lt;files wp-config.php&gt;\r\norder allow,deny\r\ndeny from all\r\n&lt;\/files&gt;\r\n<\/code><\/pre>\n<h3>Hide .htaccess<\/h3>\n<p>You will also want to protect the .htaccess file if.<\/p>\n<p><strong>Add the following to your .htaccess file:<\/strong><\/p>\n<pre><code>&lt;files ~ \u201c^.*.([Hh][Tt][Aa])\u201d&gt;\r\norder allow,deny\r\ndeny from all\r\nsatisfy all\r\n&lt;\/files&gt;\r\n<\/code><\/pre>\n<p>You can find the .htaccess file using FTP and edited with a text editor app, but you can also see it in cPanel. Log in and go into your file management and allow display of hidden files. It should be in the root directory of your server.<\/p>\n<h2><strong>TIP:<\/strong><\/h2>\n<p>if you choose option 1. You can use this file manager to upload the blank index.php to your wp-content\/uploads directory.<\/p>\n<p>I hope this has helped you make your WordPress site more secure. Is there any security issue you would like to know more about or If you have any questions, please feel free to leave us a comment.<\/p>\n<\/div>\n<p>This post was originally posted on <a href=\"https:\/\/www.mphcreative.com\/leaving-wordpress-files-exposed-2\/\">MPH Creative Blog<\/a> as a guest post by myself<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Are you using WordPress, there may be an issue you don\u2019t know anything about that\u2019s affecting the security of your uploaded files. Just because you have it set up so that<\/p>\n","protected":false},"author":1,"featured_media":1467,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"order-bump-settings":[],"_wpfnl_thankyou_order_overview":"on","_wpfnl_thankyou_order_details":"on","_wpfnl_thankyou_billing_details":"on","_wpfnl_thankyou_shipping_details":"on"},"categories":[274,91,214,223],"tags":[142,144,141,143,139,140],"_links":{"self":[{"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/posts\/1466"}],"collection":[{"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/comments?post=1466"}],"version-history":[{"count":0,"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/posts\/1466\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/media\/1467"}],"wp:attachment":[{"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/media?parent=1466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/categories?post=1466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jdthomson.com\/wp-json\/wp\/v2\/tags?post=1466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}