Malicious actors usually exploit vulnerabilities in themes and plugins present in wp-content and wp-includes directories of your WordPress application.
They use them to upload and execute backdoor files and malware to your website. Therefore, we recommend restricting direct access and execution of PHP files.
It helps to block remote access and execution of any PHP file present in these directories and offers protection to your website against such malicious attacks.
Note:
Backdoor refers to methods of gaining illicit access to a website through means that bypass authentication methods, such as file injections using PHP.
How to Restrict Direct Access to WordPress PHP Files
Direct access to PHP files is disabled by default if you launch a new application. If your application has direct access enabled and you want to disable it, you can follow these steps.
Step #1 — Navigate to Application Settings
Log in to your Cloudways Platform using your credentials.
From the Side bar menu bar, click on Flexible.
Click on My Applications.
3. Next, select the application.
5. Under Application Management, select Application Settings.
Step #2 — Click on WordPress
In Application Settings, click on WordPress in the tab appearing on top.
2. Scroll down to the Direct PHP File Access option. Here, you can see the toggle on/off button for this option.
3. If the button is turned on, turn it off by clicking on it.
4. ‘Disable’ means that direct access to PHP files is restricted; whereas, ‘Enable’ means that direct access to PHP files is allowed.
5. You will be prompted a confirmation pop-up, where you need to click on Confirm.
Wait for a few seconds, once you receive the following message on the top right side of your screen, it confirms your Direct PHP File Access is Disabled.
Note:
You can also use the same options to enable Direct Access to WordPress PHP Files using the same process.
That's it! We hope this article was helpful.