Comments on: How to stop people viewing files in a directory

By: Mark Freeman

Mark Freeman — Sun, 21 Mar 2010 06:22:29 +0000

Hey, thanks for the advice … i was leaving some places that should be locked wide open … fixed now

By: malcom

malcom — Sat, 30 May 2009 21:33:14 +0000

Very good article just what i was looking for. I’m very lazy by not learning more on .htaccess and didn’t know i could do this.

Thanks a lot, Malcom

By: Best internet Marketing

Best internet Marketing — Wed, 31 Dec 2008 17:36:10 +0000

More good advice, but I am way ahead of you here. I pay too much attention to the details that’s why it takes me 3 days to setup wordpress.

By: David Shaw

David Shaw — Wed, 05 Nov 2008 11:21:05 +0000

I always used the blank index.htm file in directories, have tried using .htaccess a few times, but always find it easier to slip in some blank indexes.

It all depends on your preference I suppose

By: Abdul

Abdul — Mon, 03 Nov 2008 13:50:46 +0000

It’s like you read my mind, I really wanted to know that because I recently discovered that all of my directory browsing was enabled!
Thanks a bunch!

By: Kevin Muldoon

Kevin Muldoon — Sun, 02 Nov 2008 02:17:17 +0000

Good comment John. Yes a default index.html file would work as well. Most php scripts put a blank index file in subdirectories so that people can’t see it. Now that I think about it, why doesn’t WordPress do this?

By: John Lessnau

John Lessnau — Sat, 01 Nov 2008 16:34:40 +0000

Yes I am amazed by the people that don’t hide their plugin directories, and yes, it is best to hide these directories from prying eyes like mine :-0.

For those WordPress users not comfortable with the .htaccess solution. Another, almost as good hiding method is to upload a blank index.htm file to the directory you don’t want people view. By default, browsers will get the blank HTM file. Sometimes I like to put a snarky message on the index.htm file like “Nothing for you to see here, move along….”

The negative with the index.htm solution is that it only protects the folder it is in and not the child folders. So:

/wp-content/themes/ would bring up the default index page

but

/wp-content/themes/scam_google_theme/ would be viewable in all its glory.

-John