One Simple Way to Protect Your WordPress Plugins

I’m amazed that so many popular bloggers use WordPress and don’t protect their WordPress plugins. Here’s one simple way to protect people from seeing exactly which WordPress Plugins you’re using.

First, here’s a little background about it: If you don’t have a default web page (usually index.html or default.html or something similar) in each of your web site’s folders, then people can gain direct access to that folder’s contents by accessing it in a web browser. For example, try going to www.yourdomain.com/images/ in your favorite browser. See what I mean? You’ll most likely see a list of all the files in that folder. For most people, seeing the image files in your images folder is not a big deal. In fact, I even let people see the files I have in my images folder. No big deal.

But what if folders in your installed apps are open?

That’s right. What if there are key folders in applications or scripts that are left open for everyone to view? Exactly–they can view all the files in that folder (or directory).

Like me, you may be proud of the different WordPress plugins that you are using if you’re using WordPress to power your site or blog. Did you know that a default installation of WordPress actually doesn’t protect your WordPress plugins folder? Well, it doesn’t! So, most likely, people can go here and view all of the plugins you have installed, even some custom ones if you’re using them:

www.yourdomain.com/wp-content/plugins

Try it now on your own WordPress-powered site or blog. There’s a good chance that you’ve left yourself wide open. And if you’re using an anti-spam plugin then people can see which one(s) you’re using. Not good.

To be honest with you, I kind of stumbled across the fact that most people have their plugins open for everyone to view. I was interested in a certain blogger’s plugins so-to-speak and which ones they were using because I kept seeing some additional pings and additional links to his blog (yes, this blogger shall remain nameless, but you know who you are if you’re reading this post!). I actually checked some (ahem) other popular bloggers, even bloggers in the Technorati 100 and they’ve left their plugins folder wide open.

So, if you’re reading this, here’s (finally) the way to protect your WordPress plugins from being viewed by snoops:

Copy the following code and paste it into notepad or whatever text editor you use:

plugin-fix.txt

Save the file as index.html and upload that file to your blog’s wp-content/plugins folder. Voila! Fixed! Now you have to FTP into that folder or go to the Admin section of your blog in order to view the plugins you’re using.

If people view your WordPress plugins and see which ones you have installed, then it may not actually be a big deal to you. But, if you’re like me and you use certain plugins to add certain functionality to your WordPress install, then most likely you will not want people snooping around, looking at all of the WordPress plugins that you have installed.