Security: Disable Directory Listing

[cloudsidedev]

Security: Disable Directory Listing

[ivomarino]

@swissspidy take a look at https://github.com/ttssdev/appflow/blob/master/playbooks/roles/web/templates/wp_bedrock/htaccess.j2 -- we provision this as default .htaccess. When we set htaccess_ithemes_security_enable: true for a vhost in conf_vhosts_common we also enable all the iThemes Security Config Details which should include what you need, take a look at the file.

[ivomarino]

Disable Directory Listing everyhwere has been implemented with 68b9e2f, verified by @swissspidy.

[ivomarino]

@swissspidy any code for Disallow executing PHP directly in wp-includes and web/app?

[swissspidy]

Usually we'd do something like this:

<Directory "/app/uploads/">
<Files "*.php">
Order Deny,Allow
Deny from All
</Files>
</Directory>

But apparently, we can easily set this via iThemes Security. As long as the current .htaccess from that plugin is correct, it should work. It does this by adding new rewrite rules:

<IfModule mod_rewrite.c>
	RewriteEngine On

	# Protect System Files - Security > Settings > System Tweaks > System Files
	RewriteRule ^wp-admin/install\.php$ - [F]
	RewriteRule ^wp-admin/includes/ - [F]
	RewriteRule !^wp-includes/ - [S=3]
	RewriteRule ^wp-includes/[^/]+\.php$ - [F]
	RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F]
	RewriteRule ^wp-includes/theme-compat/ - [F]

	# Disable PHP in Uploads - Security > Settings > System Tweaks > PHP in Uploads
	RewriteRule ^app/uploads/.*\.(?:php[1-7]?|pht|phtml?|phps)$ - [NC,F]

	# …
</IfModule>

How can I update the .htaccess with the latest updates from iThemes security to test this?