1

We are using Wordpress in Production environment. Wordpress has few vulnerabilities associated with xmlrpc.php file. Looks like one of the preventive measures it to lock down access to xmlrpc.php. This can done using the following

<Files xmlrpc.php>
    Order allow,deny
    Deny from all
</Files>

I verified access to this file is really getting blocked using wget/curl to download the file.

My concern is for httpd to read .htaccess, I need to change the following settings AllowOverride to All in httpd.conf which itself is a concern.

Please suggest what is the better way to handle this .

1

Put the <Files ...>...</Files> rule in your apache configuration rather than in .htaccess, somewhere in the <Directory>...</Directory> or <Location>...</Location> definition of your Wordpress install.

This will be faster, too, as without Allowoverride all, apache doesn't have to read .htaccess for every directory it accesses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.