How to Protect WordPress Files

Your WordPress website is a valuable asset, built with time, effort, and investment. But have you thought about what holds it all together? The core files and folders of your WordPress installation are the bedrock of your site. Leaving them unprotected is like leaving the doors to your house wide open. Learning how to protect WordPress files is not just a task for developers; it’s a fundamental step for any site owner serious about security.

This guide will walk you through practical, easy-to-understand methods to secure your website’s files. We will cover everything from setting correct file permissions to using security plugins and htaccess rules. By the end, you will have a clear action plan to fortify your site against common threats.

Why Protecting Your WordPress Files Matters

Before diving into the “how,” it’s important to understand the “why.” Your WordPress site is composed of three main parts: the database, your content (themes, plugins, uploads), and the core WordPress files. If a malicious actor gains access to your files, they can:

• Inject malware or spam that harms your visitors and your reputation.
• Deface your website, replacing your content with their own.
• Steal sensitive user data, leading to legal and financial trouble.
• Use your server to attack other websites.
• Delete your entire website, erasing all your hard work.

Protecting your files is a proactive measure that significantly reduces your vulnerability to these attacks.

1. Set Correct File and Folder Permissions

One of the most effective ways to protect WordPress files is by setting the correct permissions. File permissions tell the server who can read, write, and execute files. Incorrect permissions can allow an attacker to upload malicious scripts or modify your core files.

In the world of web servers, permissions are represented by a three-digit number.

• Files: The recommended permission setting for files is 644. This means the owner can read and write, while the group and others can only read.
• Folders (Directories): The recommended setting for folders is 755. This allows the owner to read, write, and execute, while the group and others can only read and execute.
• wp-config.php: This file is extra sensitive as it contains your database credentials. You should set its permissions to 440 or 400 to make it unreadable to anyone else on the server.

You can change file permissions using an FTP client like FileZilla or through the File Manager in your hosting control panel (like cPanel). Simply right-click on a file or folder, find the “File Permissions” option, and enter the correct numeric value.

2. Secure Your wp-config.php File

The wp-config.php file is the most critical file in your WordPress installation. It holds the keys to your database kingdom. Protecting it is non-negotiable.

Move the wp-config.php File

Did you know you can move your wp-config.php file one level above your public WordPress root directory? WordPress is automatically programmed to look for it there if it can’t find it in the usual spot. This makes it inaccessible from a web browser, adding a significant layer of security.

For most standard installations, the root directory is public_html. You can simply move the wp-config.php file from /public_html/ to the directory just outside it.

Deny Access with .htaccess

If you can’t move the file, you can add a snippet to your .htaccess file to block anyone from accessing it directly. Add the following code to the top of your .htaccess file, which is located in your site’s root directory:

<files wp-config.php>
order allow,deny
deny from all
</files>

This tells the server to deny all requests from web browsers trying to view the wp-config.php file.

3. Disable File Editing from the Dashboard

WordPress includes a handy feature that allows administrators to edit theme and plugin files directly from the dashboard. While convenient, this is a major security risk. If an attacker gains admin access, they can use this editor to inject malicious code into your files.

You can disable this feature by adding a single line of code to your wp-config.php file.

1. Open your wp-config.php file.
2. Add the following line just before the /* That's all, stop editing! Happy publishing. */ comment:

define('DISALLOW_FILE_EDIT', true);

Save the file, and the Theme and Plugin editors will disappear from your WordPress admin area.

4. Protect the uploads Folder

The uploads folder is where all your media files are stored. It’s also a prime target for attackers who want to upload malicious scripts. A common tactic is to upload a PHP file disguised as an image. When executed, this file can give them control over your site.

You can prevent this by stopping PHP files from executing within your uploads directory.

1. Create a new file on your computer and name it .htaccess.
2. Add the following code to the file:

<Files *.php>
deny from all
</Files>

3. Upload this new .htaccess file directly into your /wp-content/uploads/ folder using your FTP client or hosting file manager. This rule will block any direct access to PHP files within that folder and its subfolders.

5. Use a WordPress Security Plugin

While manual methods are powerful, a good security plugin automates many of these protections and provides comprehensive monitoring. These plugins offer features like:

• File Integrity Scanning: They scan your core files, themes, and plugins for any unauthorized changes.
• Firewall: A web application firewall (WAF) blocks malicious traffic before it even reaches your site.
• Malware Scanning: They regularly check your site for malware and help you remove it.
• Login Protection: They secure your login page against brute-force attacks.

Top security plugins like Wordfence Security, Sucuri Security, and Solid Security (formerly iThemes Security) are excellent choices. They make it easy to monitor and protect your WordPress files without needing deep technical knowledge.

Take Action to Secure Your Site Today

Your website’s security is not a “set it and forget it” task. It requires ongoing attention. By taking these steps, you can significantly harden your WordPress installation and protect your valuable files from attackers.

Start today. Review your file permissions, secure your wp-config.php file, and disable the dashboard file editor. These actions create a strong foundation for a secure and successful website.

Learn How to Prevent Direct Access in WordPress