You don’t really need to remove these files. It’s much easier to just block access to them. If you are using pretty URL’s you already have an .htaccess file. Using .htaccess to block the files is secure and you only have to add a directive once.
Blocking files is done by adding a directive to .htaccess like this:
<files filename.file-extension>
order allow,deny
deny from all
</files>
So, to block readme.html you do this:
<files readme.html>
order allow,deny
deny from all
</files>
Do the same with the license file or any other file you want to prevent anyone from accessing. Just open .htaccess in Notepad or any other basic text editor, add the directives and save, making sure that the text editor keeps the file name exactly – without any .txt on the end.
Related Posts:
- Is moving wp-config outside the web root really beneficial?
- Generate WordPress salt
- Garbage in beginning of wp-config.php – was this WP installation compromised?
- How does the “authentication unique keys and salts” feature work?
- Securing wp-config leads to sensitive information leak on wp-settings
- Is there any point setting the keys and salts in wp-config.php?
- What’s the point of forbidding access to wp-config.php?
- Where to store OAuth 2.0 client id and secret?
- Config file with no Keys..?
- White screen of death on admin pages after moving wp-config up two levels for security
- Storing FTP details in wp-config.php
- My Site keeps crashing due to the wp-confg file being deleted
- Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
- How to change location of wp-config.php to folder or 2 folders up?
- Adding Security Keys?
- Remove hacked code – out of ideas! [closed]
- Secret keys in SCM
- wp-config.php moved above root results in no plugin updates
- wp-config.php file and code injection
- Malware/Permission bug removal?
- Default installation permissions for wp-config.php
- Move data from wp-config to another file
- What is the difference between a cer, pvk, and pfx file?
- How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
- Error `sec_error_revoked_certificate` when viewed in Firefox only
- Convert .pfx to .cer
- Why should I use the esc_url?
- Where to securely store API keys and passwords in WordPress?
- Why are passwords exportable as plain text in WordPress?
- Full path disclosure on rss-functions.php
- What to use instead of wp_kses() in user output
- Are the default salts secure?
- Is there a way to force ssl on certain pages
- Subscribe to email for security fixes?
- What is the purpose of having a token in cookies?
- How to escape custom css?
- Understanding SVG vulnerabilities in WordPress related to a specific fix
- How is password strength calculated?
- How to secure or disable the RSS feeds?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- Disable external access to REST API Endpoint
- Make password invalid once logged out of password-protected page
- What is the wp-includes/certificates/ca-bundle.crt used for?
- WordPress salts set in config and database
- Disallow file edit not preventing plugin install
- How to secure WordPress XMLRPC?
- Protecting HTML5 video [closed]
- How can I find security hole in my wordpress site?
- Does WP show me if I’m logged in from multiple locations?
- Do I need to use the esc_html() function on hard coded links?
- WordPress Malware Problem help! [duplicate]
- Frontend Password change
- Restrictive File Permissions
- Downloading File from Outside Web Root
- Why are xmlrpc.php and wp-cron.php being called so often?
- Using esc_html with HTML purifier and CSSTidy: Overkill?
- wordfence scan warning on W3 Total Cache [closed]
- site get login attempts after htaccess ip restriction
- Is it good security advice to install wordpress in subdirectory but link to root?
- wp-config.php modified?
- Moving wp-config.php up 2 levels
- How Could I sanitize the receive data from this code
- WordPress SQL Injections through User Agent
- How to save iframe tag into a post?
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- What permissions should I give directories if I want to make WordPress more secure?
- How to protect wp-admin through .htaccess?
- Something is unescaping all html entities before output to browser [closed]
- Is wp_kses the right approach in sanitizing this string?
- 404 redirect wp-login and wp-admin after changing login url [closed]
- Renaming install.php for security?
- Limit Login Attempts BEFORE PHP is executed?
- Which Versions of WordPress Ship with the Patched TimThumb?
- Safe to say WordPress security releases don’t have database upgrades
- Use global variables or function that returns said variables for site-wide private-ish WP settings?
- How to add API security keys into JS of wordpress securely
- fail2ban to prevent Brute Force Attacks on WordPress?
- Use Google authentication for pages within a website [closed]
- How to give the same error message when the wrong password or wrong username is used?
- How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
- Secure Server after configuration
- Uploading attachment (pdf) and prevent download for anonymous user
- After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
- Specific Page/Post Need to Stay Non SSL
- Should I prevent access to .htaccess and wp-config.php files?
- Block JSON access over the net
- Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
- Scan multiple websites for malware that are in same webhost root?
- The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
- Security: AWS (shared hosting) claims template file malicious
- How to check whether a site has been compromised without browsing into it?
- My site thinks it’s secure when it is fact not
- Is it possible to only have the admin interface bind to the local loopback?
- PHP Code Sniffer – WordPress VIP Coding Standards
- Trying to understand nature of hacking
- Correct setup to block file modifications from hackers
- Is my WP site being hacked?
- Heartbleed: What is it and what are options to mitigate it?
- OpenVPN vs. IPsec – Pros and cons, what to use?
- How to test if my server is vulnerable to the ShellShock bug?