When writing the post Stop your laptop from succumbing to thermal death I wanted to upload a text file which could be downloaded by the readers. The file didn’t have any extension and as such was not accepted by WordPress when I pressed the Upload button.

I decided to upload the file with the File Manager which is accessible from Hostgator’s cpanel. When doing it, I discovered that various folders which belong to olivetalks’s WordPress installation can be easily seen in web browser by editing the URL in the address bar. For example, olivetalks.com/wp-content/uploads/ or olivetalks.com/wp-includes/

Currently these links are already fixed but here’s an image of how this was before:

Content of WordPress uploads folder

Check your own WordPress blog, it’s possible that you will encounter the same issue even if your WordPress installation is not hosted with Hostgator.

Now that I got your attention, here’s a short description of how to fix this problem. In the main folder of your WordPress installation (the one which contains three folders wp-admin, wp-content and wp-includes) find file called .htaccess (dot at the beginning of the name is important). If the file is not there create it (and set the permissions to 0644). In any case edit the file and add this line:

Options -Indexes

This line will tell Apache (the most popular web server) not to show listings of directories. The configuration applies to the folder where the .htaccess file is located and recursively to all its sub-folders.

After updating .htaccess file – if you try any of the problematic folders you’ll see that their content cannot be seen any more:

Content of WordPress uploads folder after correcting the .htaccess file

Now it’s all right :)



Subscribe to olivetalks to receive an email whenever a new post appears in the category of your choice.
Print This Post Print This Post

Tags: , ,

2 Responses to 'Security problem with WordPress'

Subscribe to comments with RSS or TrackBack to 'Security problem with WordPress'.

  1. June 10th, 2009 at 8:31 am
    albert said,

    scary! :)

  2. June 23rd, 2010 at 12:19 am
    jodi said,

    You wouldn’t happen to know a reliable source for setting up Thunderbird do you? I have found a TON of resources and none of the screen shots match what TB looks like now. I printed this post, excellent. Cracked me up!!! About the Inodes or whatever they were (some other post of yours).

Post a comment