[wp-trac] [WordPress Trac] #53271: How to stop direct access wp-includes files

[WordPress Trac]

#53271: How to stop direct access wp-includes files
----------------------------+-----------------------
 Reporter:  classicalrehan  |       Owner:  (none)
     Type:  defect (bug)    |      Status:  reopened
 Priority:  normal          |   Milestone:
Component:  General         |     Version:  5.7.1
 Severity:  critical        |  Resolution:
 Keywords:                  |     Focuses:
----------------------------+-----------------------

Comment (by annayasfiha):

 This has come up a few times before, for example in #36177, #30806,
 #44700, #45773, and most recently in #48049.

 Per the Security FAQ, these errors are considered a server configuration
 issue rather than a security issue:

 Why are there path disclosures when directly loading certain files?
 This is a server configuration problem. Never enable display_errors on a
 production site.

 Instead of changing all PHP files to add a check for ABSPATH, this should
 be done in a central location, which is being discussed in #36177.

 Let's continue the discussion in that ticket, as it would be best to keep
 all discussion on the general idea of "blocking malicious requests" in a
 single place, even if any implemented change does not necessarily follow
 how the ticket originally intended on it being implemented.

 That said, it looks like this ticket is more about unnecessary error
 logging rather than a path disclosure. Still, blocking direct access to
 the files in question using the web server configuration file should
 resolve the issue for now, until any changes are implemented in core.


 The ticket mentions existing work on responsive design starting from
 comment 17 in the meta ticket - what specific responsive improvements have
 already been implemented, and what areas still need design feedback from
 the community?

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/53271#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform