How to restrict access to sensitive files in WordPress

Understanding Sensitive Files in WordPress

WordPress relies on several core files vital to its operation. Some of these files hold configuration settings, security keys, and other sensitive data that, if exposed, could compromise your site’s security. Protecting access to key files like wp-config.php, .htaccess, and xmlrpc.php is essential to keep your WordPress site secure. By blocking access to these files, you prevent unauthorised users from viewing or modifying their contents, shielding your site from brute-force attacks, code injections, and unauthorised access.

Why Limiting Access to Sensitive Files is Important

Sensitive files contain critical information that keeps your website secure and functional. Key files to secure include:

1. wp-config.php: This file stores configuration details like database login credentials and authentication keys. If attackers access this file, they could gain control of your entire site.
2. .htaccess: This Apache server configuration file sets essential security rules, such as access restrictions and redirects. Securing .htaccess ensures these rules remain intact.
3. xmlrpc.php: This file supports remote access for mobile apps, plugins, and services like Jetpack, but it is also a frequent target for brute-force attacks. Limiting or disabling access to xmlrpc.php can help block these attacks.
4. wp-admin Directory: This directory holds files that manage the WordPress dashboard. Limiting access to the wp-admin directory reduces the risk of unauthorised users reaching your backend.
5. error_log and debug.log Files: If debugging is enabled, WordPress may log sensitive information. Securing these log files prevents exposing potential vulnerabilities or data.

How to Limit Access to Sensitive Files

Protect wp-config.php Using .htaccess Rules To prevent external access to the wp-config.php file, add these lines to your .htaccess file:

<files wp-config.php> order allow,deny deny from all </files> 

This code ensures only the server can access wp-config.php, blocking direct access attempts from browsers.

Secure .htaccess and .htpasswd files. If using .htaccess for security, you should secure this file and any .htpasswd file used for password protection. Add this rule to .htaccess to restrict access:

<files ~ "^\.ht"> order allow,deny deny from all </files>

This command blocks external access to all files beginning with .ht, protecting .htaccess and .htpasswd.

Disable Access to xmlrpc.php (if unused) If xmlrpc.php is not required, consider disabling it to prevent brute-force attacks. Use this code in .htaccess:

<files xmlrpc.php> order allow,deny deny from all </files>

Alternatively, plugins like Disable XML-RPC or Jetpack allow you to manage this file’s functionality securely.

Limit Access to the wp-admin Directory Restricting access to wp-admin helps secure the WordPress backend. You can limit access by allowing specific IP addresses only. Add this code to your .htaccess file in the wp-admin folder, replacing xx.xx.xx.xx with your IP address:

<Files *>
    order deny,allow
    deny from all
    allow from xx.xx.xx.xx
</Files

If multiple administrators need access, add additional IP addresses as needed. Alternatively, use multi-factor authentication if your IP changes frequently.

Disable Directory Browsing Some web servers allow directory browsing, which can expose directory contents. Disable directory browsing by adding this line to .htaccess:

Options -Indexes

This hides directory contents from public view, adding a layer of security.

Disable File Editing in the Dashboard WordPress enables administrators to edit theme and plugin files from the dashboard, but this can be risky if an admin account is compromised. To disable this option, add this line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

This removes file-editing capabilities from the dashboard, so theme and plugin files can only be changed through secure methods like FTP.

Limit Access to error_log and Debug Files Error logs can reveal potential vulnerabilities. If debugging is active, WordPress may create a debug.log file in wp-content, which could contain sensitive information. To secure these logs, add this rule to .htaccess:

<files debug.log>
    order allow,deny
    deny from all
</files>

If you don’t require debugging, disable it in wp-config.php with these settings:

define( 'WP_DEBUG', false );
define( 'WP_DEBUG_LOG', false );
define( 'WP_DEBUG_DISPLAY', false );

Suggested Plugins to Aid in Restricting Access

1. All In One WP Security & Firewall: Offers various security settings, including XML-RPC disabling, access restrictions, and IP-based access control for wp-admin.
2. iThemes Security: This plugin prevents access to important WordPress files and offers features like brute-force protection and file change detection.
3. WP Security Audit Log: Logs access attempts and activities on your site, allowing you to monitor and respond to unauthorised attempts.
4. Disable XML-RPC: This lightweight plugin disables xmlrpc.php, blocking unauthorised access.

Monitoring and Testing File Security

After configuring access restrictions, monitor and test your setup regularly:

• Run Security Scans: Use plugins like Wordfence or Sucuri Security to run scans that detect unauthorised access or vulnerabilities.
• Test Access Restrictions: Use a VPN or private browser to simulate external access and verify that sensitive files are inaccessible.
• Enable Logging: Monitor server logs or use a logging plugin to track attempts on sensitive files, helping you adjust security settings if necessary.