<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Assume you can use no index option in htaccess file for that directory. <br><br>Sent from my iPad</div><div><br>On Sep 15, 2015, at 6:09 PM, Joseph Ugoretz <<a href="mailto:joseph.ugoretz@mhc.cuny.edu">joseph.ugoretz@mhc.cuny.edu</a>> wrote:<br><br></div><blockquote type="cite"><div>
<style>body{font-family:Helvetica,Arial;font-size:13px}</style>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
Sorry I can’t give anything useful for the google questions--except that Google ALWAYS knows where everything is and can return it in a search result if they want to! :-)</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<br>
</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
But for the more basic one of protecting uploaded files, I blogged about the very problem a couple years ago. </div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<a href="http://prestidigitation.commons.gc.cuny.edu/2013/08/11/protecting-uploaded-files-in-wordpress/">http://prestidigitation.commons.gc.cuny.edu/2013/08/11/protecting-uploaded-files-in-wordpress/</a></div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<br>
</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
Daniel Bachhuber (who may still be on this list?) directed me to a good solution, the WP Document Revisions plugin.</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<br>
</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
That at least gives you the option of protecting uploaded files. It doesn’t by default protect all files, but it does let you be a bit more confident than just security by obscurity for the files that do need to be kept private. </div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<br>
</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
Joe</div>
<br>
<div id="bloop_sign_1442354624957905152" class="bloop_sign">
<div style="font-family:helvetica,arial;font-size:13px">-- <br>
<span style="font-family: helvetica; line-height: normal;">Joseph Ugoretz, PhD </span><br style="font-family: helvetica; line-height: normal;">
<span style="font-family: helvetica; line-height: normal;">Associate Dean </span><br style="font-family: helvetica; line-height: normal;">
<span style="font-family: helvetica; line-height: normal;">Teaching, Learning and Technology </span><br style="font-family: helvetica; line-height: normal;">
<span style="font-family: helvetica; line-height: normal;">Macaulay Honors College </span><br style="font-family: helvetica; line-height: normal;">
<span style="font-family: helvetica; line-height: normal;">City University of New York </span><br style="font-family: helvetica; line-height: normal;">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__macaulay.cuny.edu_&d=BQMGaQ&c=8v77JlHZOYsReeOxyYXDU39VUUzHxyfBUh7fw_ZfBDA&r=RzuvmrjV2OCbxFATfoSTEnF5WFvuPC_o3B3MUQCetc0&m=sQ4b3quwZkeA7TpnxqKUaBVx0wNs3uYVaiy7elvgeqc&s=OBkceiMH-lhEyGmtvjTbQrmX9YWMcveUCUo9EQSiG2M&e=" style="font-family: helvetica; line-height: normal;">macaulay.cuny.edu[macaulay.cuny.edu]</a><span style="font-family: helvetica; line-height: normal;"> </span></div>
</div>
<br>
<p class="airmail_on" style="color:#000;">On September 15, 2015 at 5:59:08 PM, Ben Bakelaar (<a href="mailto:bakelaar@rutgers.edu">bakelaar@rutgers.edu</a>) wrote:</p>
<blockquote type="cite" class="clean_bq"><span>
<div lang="EN-US" link="blue" vlink="purple" xml:lang="EN-US">
<div></div>
<div>
<title></title>
<div class="WordSection1">
<p class="MsoNormal">Hello all, it appears we have had some of the files on our Wordpress network indexed in Google search results. I had assumed security through obscurity here, but it appears I was wrong.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Our network runs sites as sub-directories, and we also use domain mapping for some of them. I haven’t quite figured out how yet, but one of the mapped domains (xyz, not
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__root.url.com&d=BQMGaQ&c=8v77JlHZOYsReeOxyYXDU39VUUzHxyfBUh7fw_ZfBDA&r=RzuvmrjV2OCbxFATfoSTEnF5WFvuPC_o3B3MUQCetc0&m=sQ4b3quwZkeA7TpnxqKUaBVx0wNs3uYVaiy7elvgeqc&s=wN2_jfJoe-FyCITg47tSbLHYS3pIG-y0YqmWAwqD7LE&e=">root.url.com[root.url.com]</a>) which points to site A has shown up in search results with absolute paths to files in a completely different site B (which is actually a sub-dir site, not masked). And they load just fine – this must be an unanticipated
quirk of DNS records + the Wordpress code that routes requests.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">So we have URLs like xyz.domain/wp-content/uploads/sites/x/xxxx/xx/filename.doc coming up in results! Eek! I have already started the removal requests via Google Webmaster Tools. Again no explanation yet for how these URLs were located
by the search engines, but I’m working on possible theories.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Aside from getting to the bottom of this, I’m trying to figure out the best way to block this from happening in the future. Apache .htaccess rules are one option. Robots.txt could be another? Has anyone run into this issue before, and what
have you done as a solution? I’m a little surprised this isn’t addressed “in code”. There are many plugins that allow uploads, this is a desired and supported user behavior by default. But there are no conceivable use cases I can think of where those uploads
should be able to be indexed by bots.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Could I simply place robots.txt in the root of the WP codebase, and tell it to avoid indexing ALL files under /wp-content? Would that cover all the various access cases with direct-linked files (like graphics), domain masking/mapping, etc.?
And to fully prevent opening any uploads from outside the university network (as a decent but arbitrary perimeter), can I do the same with .htaccess or do I have to make dozens of .htaccess files per /wp-content/uploads/sites/X – in each little sub-directory?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-family:"Tahoma","sans-serif";color:#7f7f7f"> </span></p>
<p class="MsoNormal"><span style="font-family:"Tahoma","sans-serif";color:#7f7f7f">---------------------------------<br>
BEN BAKELAAR | IT Services<br>
School of Communication and Information</span></p>
<p class="MsoNormal"><span style="font-family:"Tahoma","sans-serif";color:#7f7f7f">Rutgers, The State University of New Jersey<br>
p 848.932.8710</span></p>
<p class="MsoNormal"> </p>
</div>
_______________________________________________ <br>
wp-edu mailing list <br>
<a href="mailto:wp-edu@lists.automattic.com">wp-edu@lists.automattic.com</a> <br>
<a href="http://lists.automattic.com/mailman/listinfo/wp-edu">http://lists.automattic.com/mailman/listinfo/wp-edu</a> <br>
</div>
</div>
</span></blockquote>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>wp-edu mailing list</span><br><span><a href="mailto:wp-edu@lists.automattic.com">wp-edu@lists.automattic.com</a></span><br><span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.automattic.com_mailman_listinfo_wp-2Dedu&d=BQICAg&c=8v77JlHZOYsReeOxyYXDU39VUUzHxyfBUh7fw_ZfBDA&r=RzuvmrjV2OCbxFATfoSTEnF5WFvuPC_o3B3MUQCetc0&m=sQ4b3quwZkeA7TpnxqKUaBVx0wNs3uYVaiy7elvgeqc&s=v5CsGiZKe97d376vjcQ2fWiBgWCPmoLBnioXYiNMsR8&e=">https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.automattic.com_mailman_listinfo_wp-2Dedu&d=BQICAg&c=8v77JlHZOYsReeOxyYXDU39VUUzHxyfBUh7fw_ZfBDA&r=RzuvmrjV2OCbxFATfoSTEnF5WFvuPC_o3B3MUQCetc0&m=sQ4b3quwZkeA7TpnxqKUaBVx0wNs3uYVaiy7elvgeqc&s=v5CsGiZKe97d376vjcQ2fWiBgWCPmoLBnioXYiNMsR8&e=</a> </span><br></div></blockquote></body></html>