What direct access means and why it matters
Direct access means someone visiting your WordPress site's address bar can type in a path to a file or folder and see it, rather than going through the normal WordPress pages. For example, they could visit yoursite.com/wp-admin/includes/ and see a list of files, or yoursite.com/wp-config.php and potentially see database passwords. This is a security hole because it exposes code and configuration details that should stay hidden.
WordPress is designed so visitors only see what you publish through posts, pages, and plugins. When direct access works, it bypasses that design. An attacker can scout your site's structure, find outdated plugins, or spot misconfigurations without needing to hack anything — they just type a path and look.
Blocking direct access is one of the easiest security steps you can take, and it requires no changes to how your site works for normal visitors. You are straightforward telling your web server: "If someone asks for a file directly, refuse them."
Key Takeaways
- Direct access happens when visitors can type a file path into the address bar and see WordPress code or configuration files instead of a normal page.
- The most common fix is adding code to a .htaccess file on servers running Apache, which takes five minutes and requires no plugin.
- On Nginx servers, you add similar rules to your server configuration file, which usually means asking your hosting provider to do it.
- If you cannot edit .htaccess or server config, a security plugin can block direct access, though it is slightly less efficient.
- Test your fix by trying to visit yoursite.com/wp-config.php — you should see a 403 Forbidden error, not the file contents.
Using .htaccess on Apache servers
Most WordPress hosts run Apache, which reads a file called .htaccess in your site's root folder. This file contains rules that tell Apache how to handle requests. Adding a few lines here blocks direct access to sensitive files.
Connect to your site using an FTP client like FileZilla or through your hosting control panel's file manager. Navigate to the root folder — the one that contains wp-config.php, wp-content, and wp-admin. Look for a file named .htaccess. If you do not see it, it may be hidden. In most file managers, there is a setting to show hidden files (often called "Show Dotfiles" or similar).
Open .htaccess in a text editor and add these lines at the very top, before any existing WordPress rules:
<FilesMatch "^wp-config\.php"> Order allow,deny Deny from all </FilesMatch> <DirectoryMatch "^/(wp-admin|wp-includes)/"> Order allow,deny Deny from all </DirectoryMatch>
Save the file. The first block stops anyone from viewing wp-config.php directly. The second stops direct access to wp-admin and wp-includes folders. These folders contain WordPress core files and should only be accessed through the normal WordPress process, not by typing a path.
After saving, test it: go to yoursite.com/wp-config.php in your browser. You should see a 403 Forbidden error. If you see the file contents or a blank page, the .htaccess edit did not work — check that you saved it in the root folder and that the syntax is exactly as shown.
Configuring Nginx servers
Nginx servers do not use .htaccess files. Instead, access rules live in the server configuration file, usually called nginx.conf or a file in the sites-available folder. You typically cannot edit this yourself through the file manager — your hosting provider controls it.
Contact your hosting support and ask them to add these rules to your WordPress site's Nginx configuration:
location = /wp-config.php { deny all; } location ~ ^/(wp-admin|wp-includes)/ { deny all; }
Tell them you want to block direct access to wp-config.php and the wp-admin and wp-includes directories. Most hosting providers can add this in a few minutes. After they confirm it is done, test the same way: visit yoursite.com/wp-config.php and confirm you see a 403 error.
Using a security plugin as an alternative
If you cannot edit .htaccess or contact your hosting provider to modify Nginx config, a security plugin can do the job. Wordfence, iThemes Security, and All In One WP Security all include direct access blocking as one feature among many.
Install and set up the plugin, then look for a section called "File Access" or "Hardening" in its settings. Enable the option to block direct access to wp-config.php and the wp-admin and wp-includes folders. The plugin works by intercepting requests before WordPress loads, so it is effective even though it is slightly less efficient than a server-level block.
The downside is that a plugin adds a small amount of overhead to every page load, whereas .htaccess or Nginx rules stop the request before it even reaches WordPress. For most sites this difference is unnoticeable, but on very high-traffic sites, a server-level block is preferable.
What happens after you block direct access
Once direct access is blocked, your site works exactly as before for normal visitors. Posts, pages, and admin login all function the same. The only change is that someone trying to visit a file path directly gets a 403 Forbidden error instead of seeing the file.
Legitimate WordPress processes still work because they do not request files directly through the browser. When you publish a post or upload an image, WordPress handles those requests internally — they do not go through the address bar. The block only affects requests that come from outside, through a web browser or automated scanner.
If you ever need to troubleshoot and temporarily allow direct access to a specific file, you can comment out the relevant lines in .htaccess (add a # at the start of each line) or ask your hosting provider to temporarily disable the Nginx rule. After troubleshooting, re-enable the block.
Checking if direct access is already blocked
Before you add any rules, test whether direct access is already blocked. Open your browser and visit yoursite.com/wp-config.php. If you see a 403 Forbidden error or a blank page, direct access is already blocked — either by your hosting provider, a plugin, or existing .htaccess rules. If you see the file contents or a warning about database credentials, direct access is open and you should add the block.
You can also test by visiting yoursite.com/wp-admin/includes/ — you should see a 403 error or a blank page, not a folder listing. If you see a list of files, that is another sign direct access is open.
Frequently Asked Questions
Will blocking direct access break my WordPress site or plugins?
No. WordPress and plugins do not request files directly through the browser address bar. They load files internally using PHP functions. The block only affects requests that come from outside, through a web browser or scanner. Your site will work exactly as before.
What if I see a 404 error instead of 403 when I test?
A 404 error (file not found) is actually fine — it means the request was blocked, just with a different error code. A 403 (forbidden) is more explicit and slightly better for security, but either one means direct access is blocked. If you see the actual file contents, that is the problem.
Do I need to block direct access to other folders besides wp-admin and wp-includes?
Those two are the most critical because they contain WordPress core code. You can also block wp-content/plugins and wp-content/themes if you want extra protection, but it is less common. The two core blocks stop the majority of reconnaissance attacks.
Can I block direct access without editing .htaccess or contacting my host?
Yes, a security plugin like Wordfence or All In One WP Security can do it. The plugin method is slightly less efficient than a server-level block, but it works and requires no file editing or host contact. Install the plugin, find the hardening or file access section, and enable the block.
What if my hosting provider says they cannot modify the Nginx config?
Ask if they can add the rules to a location-specific config file or a custom include file for your site. If they still cannot, use a security plugin instead. The plugin method is not ideal but it is reliable and requires no server access.