I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it includes:
- Placing apache's
wwwfolder in a separate,
- Running apache as a user with read-only access on the folders
open_basedirdisabling access to folders above WP's structure
- Permissions (640 or 740 if I recall correctly) on most folders and subfolders (except
wp-content/uploads/and a couple others). Whenever a new plugin needs to be installed, updates applied or changes made to the files, a script applies recursively more relaxed permissions temporarily.
- Apache ignores
I have not defined those policies and I'm not aware of its efficacy. However, the last item (disabling .htaccess) is causing me at least two problems:
- Stops "pretty permalinks" from working (the user-friendly URL rewrites).
- Prevents the BulletProof plugin from working (basically a collection of .htaccess directives that are supposed to protect WordPress against XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection hacking attempts, and prevent access to files such as readmes that might give away WP's versions, other config files, php .ini files and directories listings).
My question is: does disabling .htaccess present some advantage from security viewpoint that might justify losing those above listed points?