Wordpress install.php leave or delete

[Boner]

Renaming login, register, sign in links always helps reduce hit bot registrations.

Only takes minutes but you save hours if you get hacked.

[Colmike7]

Either way, there is no security risk if you keep it. Going to /install.php will just give a message that WP is already there and tells you to log in. That's not how hackers get in.

[Colmike7]

Also, renaming things won't really do anything in terms of security or to deter bots. For example, if you rename your SQL tables, just use 'show tables' to see everything and bots call this before doing anything else in there.
Also don't do things like password protecting /wp-admin with .htaccess, this will cause problems, too, like Ajax since it's in that directory for some reason.

[gotonudecom]

Either way, there is no security risk if you keep it. Going to /install.php will just give a message that WP is already there and tells you to log in. That's not how hackers get in.

Install wordpress somewhere and let us test this. If/when you have time.

[BrasSmonkey]

doesn't matter it won't run. once it's installed its useless. delete it or leave it doesn't matter. did you delete the readme and those other useless file in the root? probably not

[Colmike7]

Either way, there is no security risk if you keep it. Going to /install.php will just give a message that WP is already there and tells you to log in. That's not how hackers get in.

Install wordpress somewhere and let us test this. If/when you have time.

k
If I'm allowed to test some things on one of yours without getting in trouble, too.

[Colmike7]

Like, if I'm going to hack someone's WP install, first it depends if I'm targeting something specific or not. If I don't care who I hack, I'll just make some kind of basic plugin, update it to use a vulnerable form once people start using it, then use that to put in malicious SQL commands as an injection to get in since Mysql stores form info.

If I'm targeting a site directly, I'm not going to be trying to reinstall WP with install.php....

[gotonudecom]

Either way, there is no security risk if you keep it. Going to /install.php will just give a message that WP is already there and tells you to log in. That's not how hackers get in.

Install wordpress somewhere and let us test this. If/when you have time.

k
If I'm allowed to test some things on one of yours without getting in trouble, too.

what do you have in mind?

[Colmike7]

Install wordpress somewhere and let us test this. If/when you have time.

k
If I'm allowed to test some things on one of yours without getting in trouble, too.

what do you have in mind?

Well, I'll probably have to set up something small for this. My current WP installs all have that .htaccess password in /wp-admin like I said previously not to do, so that makes getting to install.php harder lol.. :p
Maybe in the next couple of days or something, I haven't done any real hacking in a couple years and sounds fun.

[gotonudecom]

k
If I'm allowed to test some things on one of yours without getting in trouble, too.

what do you have in mind?

Well, I'll probably have to set up something small for this. My current WP installs all have that .htaccess password in /wp-admin like I said previously not to do, so that makes getting to install.php harder lol.. :p
Maybe in the next couple of days or something, I haven't done any real hacking in a couple years and sounds fun.

I have become spoiled and started using installers, which automatically remove index.php.
I would need to manually install on one of my servers. Will do as soon as I get that whim and then PM you the URL....

[Colmike7]

what do you have in mind?

Well, I'll probably have to set up something small for this. My current WP installs all have that .htaccess password in /wp-admin like I said previously not to do, so that makes getting to install.php harder lol.. :p
Maybe in the next couple of days or something, I haven't done any real hacking in a couple years and sounds fun.

I have become spoiled and started using installers, which automatically remove index.php.
I would need to manually install on one of my servers. Will do as soon as I get that whim and then PM you the URL....

Sounds good.
Maybe along the way I'll show you some ways that injections work. Those are more fun For example sometimes you can find a site with specific forms that you can execute SQL in and basically create a new WP user right on their site.

But, a lot of the ways that I "hacked" back in the day are more cracks. Like, sniffing data packets for the handshake packet when a device logs into a router using Commview then cracking it with Aircrack. I don't consider that real hacking, though, lol.

[Brian]

interesting points made in this topic

[TheButcher]

I'd never make it as a hacker I can't even install a script without reading the instructions 5 times lol

[Jessup]

1 click and it is deleted. Best single click you can make to secure a script.

[rx_tom]

1 click and it is deleted. Best single click you can make to secure a script.

You get my "best answer" vote