Computers and software are not perfect. We’ve all seen them make errors. That’s why it’s very important to but up blocks for when (not if) software messes up.
Did you know that if your WordPress’s database becomes corrupt, blanked, dropped, or otherwise wiped, that the next visitor can reinstall it? Yes, that’s right, in the event that your database has an major issue, the next visitor will get the installation prompt, allowing them to set the admin password, and then start building a site (with phishing links and the whole 9 yards) where yours used to be.
Well, that’s awful, right? Oh, and you won’t get a notice about it. You’ll just come back x number of days after it happens and see a new site where yours used to be.
Block it
There’s an easy way to stop that from happening. The file that performs a WordPress installation is wp-admin/install.php
, so blocking access to it will stop a reinstall attempt. (You could delete the file, but it will be remade with the next upgrade).
Apache
To block it, create/add this to your site’s wp-admin/.htaccess
file. If your site has a custom named wp-admin
or is using a subdirectory, change it accordingly.
# block reinstall
# wp-admin/.htaccess
# works on both Apache 2.2 and 2.4+
<Files install.php>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order allow,deny
Deny from all
</IfModule>
</files>
The above assumes that your Apache AllowOverride
settings are allowing the .htaccess
file to block file access. If you don’t have this, you will need to either allow it, or add the above to the site’s VirtualHost config.
NGINX
For NGINX, use this in your server config:
location = wp-admin/install.php {
deny all;
}
Test it out
Now, we need to test it to make sure it’s working. First, test your site and make sure it’s running. If it’s not review the .htaccess
file, and check your logs.
If your site works, then make sure you can’t go the install.php url. In a new window, type in your website’s url, followed by /wp-admin/install.php
so it looks like https://www.example.com/wp-admin/install.php
.
If you are using a subdirectory, make sure you include that subdirectory (https://www.example.com/subdirectory/wp-admin/install.php
).
You should get an Access Denied message, like this:
Huh? You really want to see that? Are you sure…?
… Sorry, no can do … (Error 403: Forbidden)
(That’s my custom 403 error page. For more on how to setup your own custom error pages, go here.)
If you get a message saying “WordPress is already installed, then it’s not working correctly. Check that the .htaccess
file is placed correctly, has the right permissions, then check the logs and your httpd.conf/VirtualHost settings.
Conclusion
It’s an easy fix. Once you have this in place, any major issue with the database will make your site show errors, but stop others from uploading another site. It helps to have a website uptime service in place, letting you know if you have any downtime issues.