Auto delete wp-config-sample.php after install

[discobot]

…and rename wp-admin folder

(easy and basics security…)

---

Read-only archive: Issues · ClassicPress/ClassicPress · GitHub

Author: Yannick

Vote count: 34

Status: open

Tags:

• request-modify-feature

---

Comments

Neither of these things will improve security. If you’re concerned that outsiders may try to access the wp-admin directory, just drop an .htaccess file in there and force basic HTTP auth. This is true security, rather than security by obscurity.

~ posted by John

i do, but many people don’t !!! You right about obscurity, but is still the first step to security concept, and good for a community project !

~ posted by Yannick

My only concern is if there are any compatibility issues with plugins using /wp-admin/ as hardcoded url

~ posted by Chris Chiotis

Yes the problem will be probably with all the ajax stuff because of the file admin-ajax.php inside wp-admin and many use the hardcoded version.
I am more for an htaccess file inside that folder then rename it.

~ posted by Daniele Scasciafratte

i’m upvoting only for the auto-delete wp-config-sample.php – agree – never have anything on your website that is not being used. So, one less step i have to do manually!
But auto-rename wp-admin - no.

~ posted by James Walker

Bad ideas on both counts. Core CMS should not be in the business of deleting files or data, or renaming folders and files, for any reason really.

Many users here need to think more about things like web hosts, APIs, third party integration, deployment tools, etc.

The Core CMS needs to know its place, and not overstep…

Here’s one example: WAF Firewalls around the world are configured to detect rules on URI patterns with /wp-admin/ and now you just broke them. And when WordPress Core (etc) updates, various humans and scripts might need to compare the freshest copy of wp-config-sample.php and now you broke them too, yikes! Always keep in mind what’s going on higher up in the stack…

~ posted by Jesse

Unfortunately this petition is not really usable as-is, because it covers two very different topics and we can’t know which people voted for which topic.

As far as the content of the petition, deleting wp-config-sample.php doesn’t really do anything concrete for security, and renaming wp-admin is likely to be a big can of worms, as mentioned above.

~ posted by James Nylen

[anon71687268]

Noting that this petition is attempting to address two issues, both of which are moot in terms of security.

---

Removing the wp-config-sample.php file in the name of security is akin to removing the version number in the name of security – both are “conventional wisdom” which are not based in fact. Some security plugins will optionally remove this file and that may lead some to believe it’s a security thing. In actuality, this provides no security enhancement whatsoever and is an example of how some plugins will continually add new “features” (ie, bloat) merely to stay fresh in your mind as you update every couple of weeks.

If anyone is concerned with this file – even though there’s no reason to be – an .htaccess (et al) rule can be used to prevent access. No core code changes required; one and done forever after.

---

Also, changing the admin directory provides no extra security. Unless every installation were to use a randomly generated directory name for the admin, anyone could just look at the source and see the new directory name.

[1stepforward]

This petition has been tagged as unactionable for the reasons outlined in the comment by James and the subsequent post by @anon71687268. It will close automatically at 2021-03-20T20:00:00Z.