Protect Your WordPress Plugins

[Tami]

[b]Protect Your WordPress Plugins

By Bill Hartzer[/b]

I\'m amazed that so many popular bloggers use WordPress and don\'t protect their WordPress plugins.

Here\'s one simple way to protect people from seeing exactly which WordPress Plugins you\'re using.

First, here\'s a little background about it: If you don\'t have a default web page (usually index.html or default.html or something similar) in each of your web site\'s folders, then people can gain direct access to that folder\'s contents by accessing it in a web browser. For example, try going to www.yourdomain.com/images/ in your favorite browser. See what I mean? You\'ll most likely see a list of all the files in that folder. For most people, seeing the image files in your images folder is not a big deal. In fact, I even let people see the files I have in my images folder. No big deal.

But what if folders in your installed apps are open?

That\'s right. What if there are key folders in applications or scripts that are left open for everyone to view? Exactly-they can view all the files in that folder (or directory).

Like me, you may be proud of the different WordPress plugins that you are using if you\'re using WordPress to power your site or blog. Did you know that a default installation of WordPress actually doesn\'t protect your WordPress plugins folder? Well, it doesn\'t! So, most likely, people can go here and view all of the plugins you have installed, even some custom ones if you\'re using them:

[code]www.yourdomain.com/wp-content/plugins[/code]

Try it now on your own WordPress-powered site or blog. There\'s a good chance that you\'ve left yourself wide open. And if you\'re using an anti-spam plugin then people can see which one(s) you\'re using. Not good.

To be honest with you, I kind of stumbled across the fact that most people have their plugins open for everyone to view. I was interested in a certain blogger\'s plugins so-to-speak and which ones they were using because I kept seeing some additional pings and additional links to his blog (yes, this blogger shall remain nameless, but you know who you are if you\'re reading this post!). I actually checked some (ahem) other popular bloggers, even bloggers in the Technorati 100 and they\'ve left their plugins folder wide open.

So, if you\'re reading this, here\'s (finally) the way to protect your WordPress plugins from being viewed by snoops:

Copy the following code and paste it into notepad or whatever text editor you use:

[url=\"http://www.billhartzer.com/plugin-fix.txt\"][u]plugin-fix.txt[/u][/url]

Save the file as index.html and upload that file to your blog\'s wp-content/plugins folder. Voila! Fixed! Now you have to FTP into that folder or go to the Admin section of your blog in order to view the plugins you\'re using.

If people view your WordPress plugins and see which ones you have installed, then it may not actually be a big deal to you. But, if you\'re like me and you use certain plugins to add certain functionality to your WordPress install, then most likely you will not want people snooping around, looking at all of the WordPress plugins that you have installed.

[b]About the Author:[/b]

[url=\"http://www.billhartzer.com/\"][u]Bill Hartzer[/u][/url] manages the Search Engine Marketing division of [url=\"http://www.marketnet.com/\"][u]MarketNet, Inc.[/u][/url], a leading full-service interactive design and development firm in Dallas, Texas. Hartzer recently joined MarketNet, where his vast experience significantly bolsters MarketNet\'s already robust search engine marketing offerings.

[url=\"http://www.billhartzer.com/\"][u]http://www.billhartzer.com[/u][/url]

[ner0]

I like it... but much easier just to do it through .htaccess, I sorted mine through cPanel <img src=\'http://www.killanet.net/forum3/public/s ... /happy.gif\' class=\'bbc_emoticon\' alt=\'^_^\' />

[Josh]

I think by default our servers will show an access denied message <img src=\'http://www.killanet.net/forum3/public/s ... >/blum.gif\' class=\'bbc_emoticon\' alt=\':P\' />

[Tami]

Ours might, but others might not <img src=\'http://www.killanet.net/forum3/public/s ... igwink.gif\' class=\'bbc_emoticon\' alt=\';)\' />

[rIFt]

yeah.. most dont, ours is just that special <img src=\'http://www.killanet.net/forum3/public/s ... #>/cry.gif\' class=\'bbc_emoticon\' alt=\':(\' />

[ner0]

actually I think server2 has indexes allowed by default (someone correct me if I'm wrong).

I remember having to set it explicitly for AJB at least, though I think server1 has them generally disabled.