Razva

Anybody… Really…there’s no troubleshooting plugin on Earth?!

.htaccess = https://pastebin.com/z80PLyfT
wp-config.php = https://pastebin.com/Ti1WW5E7

I’ve just logged in the client’s admin panel.

The featured image path is “https://falticeni.adventist.ro/files/2011/03/foto-munte2.jpg” (in the admin area).

The file exists on the server in “/wp-content/blogs.dir/56/files/2011/03/foto-munte2.jpg”

So obviously the file is there, but WP doesn’t “interprets” the file.

Hi Andrea,

Thanks for your answer!

I’ve done exactly the same thing, I have exactly the same .htaccess file.

Still…I have the same result ??

If needed I can offer FTP access, I really need to fix this asap…

Thank you!

Later edit: I’ve upgraded from 2.X to 3.0 and then to 3.1.

@claytonjames – thanks for your tips! I’ve already removed readme.html hehehe, that’s a nice thing to begin with ??

I’ll keep searching for a way to achieve the “no /wp-content/ in source” goal and…who knows…maybe I’ll find a way.

So, anybody…any ideas? ??

@samuel B – as replied to ClaytonJames, yes, also this is a very good way to secure a WP site.

Still, the idea in this thread is to hide /wp-content/ from the source…and as far as I understood until now there’s no way to do that.

@claytonjames totally agree, if you think at “experienced attackers”, not script kiddiez that just found a fresh exploit…

Like…a guy comes on the site and sais “hey, what CMS are they using”. They take a quick look at the source, and in 5 seconds voila…they know that you are using WP.

If such a person will not see any trace of wp-content than it will – at least – think that the website is using a custom platform and let it go.

Agreed, for persuasive hackers, this thing is not a problem, as they can try to access a system-wide directory, like /wp-admin/ (that you can’t rename), and see that you’r using WP.

So the basic idea is to make at least a “first impression” of security, for those who are more curious than they should.

@claytonjames yup, that’s my point…

So, as far as I can understand, there’s no way to hide the wp-content from the source? Wooow…than at this chapter is “1-0” for Joomla…which I really don’t need for this project…

Yeah, but if you look at the source, you can still find /wp-content/ there…

The idea here is to hide any “wp-trace” from the source. If an attacker knows what CMS are you using…you are extremely vulnerable.

So the story here is to completely hide “wp-content” from the source, not just move or restrict paths.

@postrophe can you please be more explicit?

I was thinking at a symlink, but that will not fix the fact that WP will still post /wp-content/ in its source link…

Oh, so the single thing I can do is move wp-content to files/wp-content? The idea was to move the entire wp-content to files in order to secure the site…

If I can move wp-content, but I can’t change its name, than it’s the same thing as leaving it where it is, as a hacker can take a fast look at the source code and see if he can find wp-content. He doesn’t cares if wp-content is in /files or in the rootir…

So, as a final “product”, I’m looking for a way to rename wp-content and “hide” the fact that the website is using WP, for security reasons.

Bummer!

Warning: array_keys() [function.array-keys]: The first argument should be an array in /home/remedia/public_html/wp-includes/theme.php on line 513

In the wp-config.php I’ve added, just before the ?>, the following lines:

define( ‘WP_CONTENT_DIR’, $_SERVER[‘DOCUMENT_ROOT’] . ‘/public_html/files’ );
define( ‘WP_CONTENT_URL’, ‘https://www.re-media.ro/files’);
define( ‘WP_PLUGIN_DIR’, $_SERVER[‘DOCUMENT_ROOT’] . ‘/public_html/files/plugins’ );
define( ‘WP_PLUGIN_URL’, ‘https://www.re-media.ro/files/plugins’);
define( ‘PLUGINDIR’, $_SERVER[‘DOCUMENT_ROOT’] . ‘/public_html/files/plugins’ );

I’ve tried:
/home/user/public_html/files
and
/public_html/files

Both settings generate the above error.

Ok, thanks a lot!

I’ll get back if something goes wrong.

Oh, so the defines should be done in wp-config, not in wp-settings?