Is it good security advice to install wordpress in subdirectory but link to root?

Just to add to the answer by @birgire, check this post on how to hide the fact that you are using WordPress.

I also think that no post basically covers this, but it really help nothing following and applying everything to hide the fact you are using WordPress and to secure WordPress, and your code in itself is a security risk.

Hackers are stubborn and always have a point to prove themselves that they can hack a site that they have set their mind on. The measures named in the linked post is just there to make it difficult for hackers, not to secure your site. Once hackers have the source code to your site, they can use bad, insecure code against you. For that reason, it is always very important to keep your site up to date and use only the latest code as set out in the docs, and regularly check for any code or practice that might create a loophole which hackers can exploit.

Related Posts:

  1. Should I remove install.php and install-helper.php?
  2. How to get WordPress to save upload file beyond web root [closed]
  3. Securing a multi-user permission structure
  4. wp-config.php being written by attacker
  5. Renaming install.php for security?
  6. Are there security risks in working directly in the themes folder that builds into a theme folder?
  7. wp-content – permissions for files/folders created by apache
  8. Why are the latest visits to my website originating from my own website?
  9. Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
  10. Directory to store secure file
  11. SSL Error: unable to get local issuer certificate
  12. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  13. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  14. Why does the URL http://a/%%30%30 crash Google Chrome?
  15. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
  16. Can an attacker use inspect element harmfully?
  17. Where does Internet Explorer store saved passwords?
  18. WordPress 4.7.1 REST API still exposing users
  19. Should I escape wordpress functions like the_title, the_excerpt, the_content
  20. Why does WordPress need my private ssh key to update?
  21. When to use esc_html and when to use sanitize_text_field?
  22. Will there be security updates for 3.1 once 3.2 is released?
  23. WordPress it’s cleaning a custom query_var to avoid sql injections?
  24. Can someone explain the use cases of esc_html?
  25. Tips for finding SPAM links injected into the_content
  26. Is WordPress vulnerable to the httpoxy?
  27. wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability
  28. Is there a security risk giving someone temporary access to my blog’s code?
  29. Is /wp-login.php?redirect_to[] exploitable?
  30. How to properly sanitize/secure a WP Query coming from the front end
  31. Sub-domain or 2nd, temporary different domain?
  32. Website is being flooded [closed]
  33. What is the most secure way to set up the MySQL user in WPMU?
  34. Why was my blog post inserted lot’s of ad links by others?
  35. Should I Worry About SQL Injection When Using wp_insert_post?
  36. Auth cookie value security risk?
  37. Security – Shortcode injection attack
  38. Registration Plugin – Recaptcha integration
  39. wp theme.. Could not create directory
  40. Security threat with `home_url`?
  41. How to combat flooding admin-ajax.php?
  42. When is wp_set_password() called or how to capture a password
  43. Moving away from MD5: Where to declare the custom global $wp_hasher?
  44. Would it be dangerous to send all the wp_options to javascript file?
  45. Correct folder permissions?
  46. Is there a way to hide WordPress behind a web visible directory?
  47. Should I disable directory listing for wp-includes?
  48. How to get WordPress to send Password Reset Link Email instead of New Password?
  49. Safety side of storing emoji into database
  50. How can I safely hide the fact that my website runs on WordPress? [closed]
  51. How can I display nickname instead username in links
  52. My WordPress Websites are always under attack
  53. Is there value in using a wp_nonce for POST requests?
  54. How to hide easy access to my website temporarily?
  55. Can I Remove xmlrpc.php completely?
  56. Multisite installation on an existing single installation
  57. How much should I worry about these messages?
  58. Security concerns with external links
  59. Uploading .webm format on WordPress results in security guidline breach and fail
  60. Any any insecure http:// URLs left in wordpress?
  61. White screen of death on admin pages after moving wp-config up two levels for security
  62. .htaccess password protection bypassed
  63. Can a WordPress administrator see other users’ passwords?
  64. Why my plugins are updating automatically?
  65. google xml sitemap won’t work on directory install
  66. Privilege escalation bugs in 2.9?
  67. Content-Security-Policy blocks WordPress check boxes from being activated
  68. Prevent editor from adding script or form
  69. Does WordPress refer to any files outside of the main install folder (and database)?
  70. Finding where a snippet of code is coming from
  71. wordpress admin security
  72. Remove hacked code – out of ideas! [closed]
  73. Why do people use “admin” username by default? [closed]
  74. Moving from subdirectory and subdomain -> root
  75. Powering only a subfolder with WordPress on a LAMP stack with an nginx reverse proxy
  76. WordPress Database Re-installed (Hacked)
  77. WordPress Security tools
  78. Install second wordpress in root subfolder, Error 404
  79. Robots.txt file not updating
  80. Security: Critical backend outside of wordpress
  81. Advice On How to Backup WordPress
  82. How can I stop other plugins from using my class’ sensitive methods?
  83. What are WordPress Current Security Issues in 2017?
  84. wp-config.php moved above root results in no plugin updates
  85. Installation directory for WordPress and child theme
  86. Password-protect feed and make it usable in major aggregators
  87. How to replace a wordpress installation in root directory with another in a subdirectory?
  88. Should I change the default file and folder permissions?
  89. WordPress exploited theme is causing high io load on server
  90. WP white screen of death after duping a site that works fine on same server
  91. how to find the way they hacked my WP site
  92. How to set custom validation for WordPress Passwords?
  93. Is it a bad idea to CHMOD 777 all the files on your site?
  94. is this code properly secured
  95. nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]
  96. How to get real password (before encrypt) when register a user?
  97. Our security auditor is an idiot. How do I give him the information he wants?
  98. I am under DDoS. What can I do?
  99. SSH keypair generation: RSA or DSA?
  100. WordPress – tracking options