Feb 15
19
Whether you’re running a web service or a blog, you should always keep your software fully patched to prevent attacks and minimize your attack surface. Another smart step is to prevent full path disclosures. For example, if your blog or service throws an error like “Warning: require(ABSPATHwp-includes/load.php) [function.require]: failed to open stream: No such file or directory in /home/horace/public_html/wp-settings.php on line 21″ then by noting the full pathname from that error, an attacker could reasonably infer that your username is “horace” and use that try to guess your password.
Read this article:
Fixing “full path disclosure” issues