Feature request: secure WordPress

It’s been covered before. Security via obscurity just doesn’t work and that proposal would almost certainly be impossible to support.

Hiding directories does not make anything more secure. It’s like closing your eyes and saying that that will prevent The Bad People™ from seeing you.

Such self-inflicted damage is to be avoided. ??

But give this a read on why you shouldn’t as well as the links MickeyRoush provided.

https://www.ads-software.com/support/topic/hideprotectrename-wp-installation-folders?replies=8

Hello Jan,

I know there′s not infallible solutions concerning Internet security, but WP is now really easy to hack for any novice, just with all the critical structure in a known way in the /public folder of the server.

I.E. Moodle ask you to install the content folder outside the public directory.

I.E. Magento allows you to install its critical data inside the folder you choose.

WordPress could be more secure if they learn implement by default methods that others are applying to increase security. It doesn′t remove the risks but obviously reduces them in a high percentage obviously.

Regards.

If you are interested in tightening security, see Hardening_WordPress and https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

As Jan said, this topic has been discussed to death many times.

Hello esmi,

I know there are a lot of threads, rules, plugins, etc. about this topic that anyone could apply with some acknowledge of coding and Apache settings (which not all WP users know).

What I want to say is I think it would be better that WP increases its security by default. But if you think that it isn′t a must… it was just an advice ??

Regards.

Please be patient with me for a moment. Security is a thing for me. ??

but WP is now really easy to hack for any novice

No, it categorically and 100% is not. I’m sorry, but that’s just not the case.

How do I know? Because as the timthumb exploit demonstrated, when an easy attack vector is available then the bad guys jump all over it. That’s not happening with WordPress installation en masse, we’d all know about it here if it were.

However, as the timthumb exploit illustrated there are a lot of themes, plugins, and poor hosts and some of those are the vector for compromising a lot of WordPress installations.

That’s not a problem WordPress itself can solve.

It’s like me designing and building the most secure home and the owner leaves the garage door wide open and all the doors unlocked. You could blame the designer or you could just keep your home secure.

There have been times in the past that earlier versions of WordPress have had an exploit, but those get dealt with quickly provided that the exploit is responsibly disclosed. It’s part and parcel why keeping your software up to date is important.

There are things that the user can do and they’re concisely summarized in these links.

https://codex.www.ads-software.com/Hardening_WordPress
https://www.studiopress.com/tips/wordpress-site-security.htm

I’m more fond of the second link myself.

WordPress could be more secure if they learn implement by default methods that others are applying to increase security.

Not the case. My new phrase of the week is now going to be this one.

Security via obscurity doesn’t work. It’s like closing your eyes and saying that that will prevent The Bad People? from seeing you.

Any security weakness does not come from a directory name. It comes from within the code itself. The people who make these exploits aren’t that unsophisticated and they will find those exploits regardless of how you name a directory.

Try this: visit any WordPress install and view the source.

You will see references to wp-content/themes and probably wp-content/plugins in the source code. Those files are required to get the look and functionality that that WordPress installation requires.

If you believe that renaming those directory makes it more secure, then please re-read my new phrase of the week above.

Hello Jan,

Thank you for your explanation. I am not an expert in security, and once again, if you consider that WordPress have done its best and it doesn′t need improvements, all said.

But please note that, as an user -and I speak for all people that is asking the same question-, is unbelievable that all the answers are to evade the issue, and what must increase the security are the reckless rest of the world: the users, the plugin and theme coders, the web hostings, etc. Isn′t it contradictory? As WP is done with ultimate security, it doesn′t need improvements by default actually and a simple user could make it vulnerable. I don′t want to think what a hacker could do…

Anyway, it′s not a question, just a thought. So it′s not necessary that you answer once again.

Regards.

The answers you are being given are not an evasion. There is simply absolutely no benefit, at this time, in changing or hiding these folders.

WP is not the ‘ultimate’ security. The devs just chose to spend more time actually making things security versus trying to make it feel secure. They spend time checking for cross-scripting bugs, sql injection, and other serious issues, instead of adding in features that don’t help.

Think on it this way: The more options you put in to allow people to move /wp-admin etc, the more points of attack you’ve created. It’s not making anything more secure, it just makes you feel like it is, because, oh look! You moved it! No one will find it!

Except I could pick it out in probably 10 minutes lazy work. So what did you do? Waste your time.