• Hi there,

    Looking at my logs, I saw that one ‘bad bot’ was happily trying to execute wp-content/themes/clean-enterprise/index.php directly, which is not supposed to be harmful, but annoying nevertheless.

    My only concern is that there might be some bots searching for specific versions of Clean Enterprise which they believe to be hackable (that’s not likely, though).

    However, just to be on the safe side of things, I made a few changes to index.php.

    On line 15, where there is just get_header(), I did the following:

    if (!defined('ABSPATH')) {
     	header('HTTP/1.1 403 Forbidden');
     	die('Sorry, no access outside WordPress');
     }
     if ( function_exists( "get_header" ) ) get_header(); ?>
    

    and a bit below, on line 20, where there was if ( is_front_page() ) :
    I replace it with: if ( function_exists( "is_front_page" ) && is_front_page() ) :

    Strictly speaking, those checks for existing functions should not be necessary.

  • The topic ‘Fix for stupid hackers trying to run scripts directly (not a security issue!)’ is closed to new replies.