Load all files from folder in theme – Security concerns?

Only so much security can be added at the php layer. To gain even more security, modify the .htaccess file, disabling directory browsing, disabling XML-RPC, and deny access to WP-specific files.

    <files .htaccess>
        Order allow,deny
        Deny from all
    </files>
    <files readme.html>
        Order allow,deny
        Deny from all
    </files>
    <files readme.txt>
        Order allow,deny
        Deny from all
    </files>
    <files install.php>
        Order allow,deny
        Deny from all
    </files>
    <files wp-config.php>
        Order allow,deny
        Deny from all
    </files>

    # Rules to disable XML-RPC
    <files xmlrpc.php>
        Order allow,deny
        Deny from all
    </files>

    # Rules to disable directory browsing
    Options -Indexes

Don’t want ../pxs/wp-content/uploads/ open to the web, after all. What if you uploaded a contract with significant details or something?

---

Banning the HackRepair.com Blacklist in your .htaccess file is a good idea too. Here’s what the beginning of that’d look like:

    RewriteEngine on
    RewriteCond %{HTTP_USER_AGENT} ^[Ww]eb[Bb]andit [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Acunetix [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^binlar [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^BlackWidow [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Bolt\ 0 [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:craftbot\@yahoo\.com [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^BOT\ for\ JCE [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^casper [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^checkprivacy [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw [NC,OR]