Hello,
The theme files can be requested from outside WordPress, generating a server error (HTTP 500).
Try to access to: http://yoursite/wp-content/themes/Newspaper/index.php
If you access directly to he theme files, the get_header function is not defined, so PHP returns an error: PHP Fatal error: Call to undefined function get_header().
Example: http://yoursite/wp-content/theme/Newspaper/index.php
Maybe the code could check for WordPress environment like this:
if ( ! defined( ‘ABSPATH’ ) ) exit; // Exit if accessed directly
Another solution to prevent directly access to plugin and theme code is this:
# Restrict access to PHP files from plugin and theme directories
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/file/to/exclude\.php
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/directory/to/exclude/
RewriteRule wp-content/plugins/(.*\.php)$ – [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/file/to/exclude\.php
RewriteCond %{REQUEST_URI} !^/wp-content/themes/directory/to/exclude/
RewriteRule wp-content/themes/(.*\.php)$ – [R=404,L]
Hi,
Indeed those solutions would work, so the theme files will not be accessible directly
– https://wordpress.stackexchange.com/questions/62999/worthwhile-to-restrict-direct-access-of-theme-files
Thank you for posting this solution, it might be helpful to other users.
