I decided to upload the file with the File Manager which is accessible from Hostgator’s cpanel. When doing it, I discovered that various folders which belong to olivetalks’s WordPress installation can be easily seen in web browser by editing the URL in the address bar. For example, olivetalks.com/wp-content/uploads/ or olivetalks.com/wp-includes/

Currently these links are already fixed but here’s an image of how this was before:

Check your own WordPress blog, it’s possible that you will encounter the same issue even if your WordPress installation is not hosted with Hostgator.

Now that I got your attention, here’s a short description of how to fix this problem. In the main folder of your WordPress installation (the one which contains three folders wp-admin, wp-content and wp-includes) find file called .htaccess (dot at the beginning of the name is important). If the file is not there create it (and set the permissions to 0644). In any case edit the file and add this line:

Options -Indexes

This line will tell Apache (the most popular web server) not to show listings of directories. The configuration applies to the folder where the .htaccess file is located and recursively to all its sub-folders.

After updating .htaccess file – if you try any of the problematic folders you’ll see that their content cannot be seen any more:

Now it’s all right

Related post(s)

• Inodes 28 weeks later… (2)
• Is your colleague spying on you? (0)
• The 5 stages of bloggers (3)
• Blogging strategies: length, frequency and topics (3)
• The return of the inodes – tell me your package and I’ll tell you your inodes (6)

That’s rather shocking to me. I know that as a sysadmin you have access to passwords and privileged accounts but you’re given them for a very specific purpose not just for your amusement. It’s like your GP telling everybody about your sickness.

Since it looks like avoiding the bad sysadmins is going to be difficult, you have to defend yourself. The only sure defense in this case is not to use the computer at work for anything you’d prefer to remain private. You just can’t be sure otherwise. In many organizations IT staff who left may still have access to the company’s network. This increases your exposure even more. Like for example in this organization.

By the way, the research is already over a year old but it looks like it just got picked up by MSNBC and the blogosphere.

Related post(s)

• Bad system administrators (1)
• Security problem with WordPress (2)