7

Because it was blocking Googlebot from accessing important files, I recently updated our /robots.txt file and removed most of it, including wp-admin.

Now, the people on charge of hosting and SEO stuff sent me an email warning that some of the admin pages are indexed by Google and that I must disallow the wp-admin. For security reasons.

But I don't get it, why is this a security issue? Isn't a potential attacker already aware of such files since Wordpress is pretty common and standard?

Improve this question
2
  • 3
    Anything that users don't need access to should be treated as a security threat.
    – Simon Hayter
    Feb 12, 2016 at 13:10
  • 1
    @SimonHayter Don't forget about users themselves... they're the biggest security threat of all.
    – HopelessN00b
    Feb 13, 2016 at 2:30

5 Answers 5

Reset to default
9

When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on google. Maybe will even use automated tools to find-and-exploit sites based on that.

Avoiding that would be the main security reason for doing it. If you have no public sign that you are using Wordpress (or at least not the most common ones like this), you are less likely to be a randomly chosen as target for an attack.

Improve this answer
2
  • Google don't show wp-admin page unless some webpage link to that. I have thousand of directory in my host, and none of index yet, because I have not mention that directory on sitemap or anywhere in my webpage. Google don't crawl blindly, they follow link, sitemap and old pages.
    – Goyllo
    Feb 14, 2016 at 8:05
  • I guess he hás or had a link because he said the page is already on google index. Many sites have links on the main page to the admin area.
    – CristianTM
    Feb 14, 2016 at 9:25
8

Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not something you should rely on anyway.

Useless? Definitely. There is no reason to allow indexing of your admin login in your site. You don't want your users finding a link to your admin when they are actually searching for your content. The only person who should care about that is the site admin.

Improve this answer
4
  • Actually this is not typical security by obscurity case. You do have a good reason to do it: avoid being a target, that may be your last defense on case of attacks that are out of your control as 0day exploits.
    – CristianTM
    Feb 14, 2016 at 10:05
  • You won't avoid being a target by hiding your admin site from search engines. Maybe delay it for a couple minutes but nothing more than that. You will probably get found earlier by some automated script running around from site to site than from some search engine (in case of someone looking for sites to exploit).
    – cdvv7788
    Feb 14, 2016 at 16:55
  • Going from known word press site to site looks much easier than going from every single indexed site to site at random, dont you think? ;) thats why not only for that, but usually it is a good practice to hide the "fingerprint" (software id, version, etc) from any site.
    – CristianTM
    Feb 14, 2016 at 17:04
  • Good practices are a good thing, too bad that not many people follows that (specially in the realm of wordpress). Also, scripts are meant to run around checking site to site, normally without any input from some search engine. You would be surprised by the quantity of wordpress sites that you can find in 15 minutes. Unless there is some specific interest on my site, i won't get special treatment and be attacked alone :(
    – cdvv7788
    Feb 14, 2016 at 17:15
7

Google doesn't want to index non-content pages including admin pages and pages that ask you to login. Putting wp-admin in robots.txt is better for SEO because it will usually prevent the page from being indexed.

It is possible that an attacker will do a Google for all sites that have wp-admin in the URL. Keeping that page on your site out of the Google search results will make it less likely for an attacker to find your site.

Improve this answer
1
  • 100% agree, Google can't crawl password protected directory.
    – Goyllo
    Feb 14, 2016 at 8:02
5

If I was running wordpress, then I will not block anything with robots.txt, because it prevents Google for crawling, not for indexing. Just search on Google "Google analytics Web", and you will see link which is blocked in robots.txt, but still it is exist in search result.

And by default, Assets files like css, js and images are stored in wp-admin directory, so it will cause error to render correctly for Google spider.

And, there are so many Google dork to find out bulk wp-admin pages in Google search result, and your site will be visible if you just using robots.txt for prevent.

I suggest use only noindex meta tags in wp-admin.

And here many of people talk about security, but Google can't crawl password protected directory.

Extra note: Don't use both. I mean if you block wp-admin directory in robots.txt, then Google will never know, you have placed noindex meta tags in wp-admin, because they follow robots.txt first then meta tags on webpages.

Improve this answer
1

wp-admin on wordpress is direct entry to your admin panel. That's why google wants you to disallow it. And... in this case, listen to google and srsly, disallow it. It's good practice :)

Improve this answer
6
  • 3
    But, everybody knows that wp-admin is direct entry to most (if not all) Wordpress sites. Does a hacker needs to google it? I don't think so. Hence my question. Why would indexing the famous directory be a threat in and by itself?
    – sudo --do-it
    Feb 12, 2016 at 13:50
  • @sudo--do-it It makes it very easy for a hacker to know there is a potential vulnerability on your site. WP is the most hacked software ever and has always been. It is not that WP is bad, it is just a lot of code including themes and plug-ins that can often be vulnerable due to poor coding practices or mistakes. As as matter of practice, you should be restricting access to your admin pages as much as possible and not leaving it for the world to see if possible. Hackers try various WP admin directories to see if the site is a WP site and then begin hacking. Cheers!!
    – closetnoc
    Feb 12, 2016 at 17:33
  • @closetnoc "hackers try various WP admin directories" - Isn't that exactly why it doesn't matter whether wp-admin is indexed by Google? A hacker doesn't need to see the admin page to know that you've got Wordpress installed, and then they can just try any standard WP directory path on your site.
    – recognizer
    Feb 12, 2016 at 18:47
  • @recognizer It is a catch 22... ;-) but if your door lock does not work, you do not put a sign on the door stating such. Either way, it should not be indexed. For security reasons, you do want to hide the admin directory as much as possible. Generally, WP fails one of my first and strongest security No No's - cannot change the admin directory.
    – closetnoc
    Feb 13, 2016 at 1:02
  • @recognizer the most common type of attacker is not aware of your site in the first place, much less what it's running. If your adminpage is indexed, then you're vulnerable to attacks that automatically target all publicly visible wordpress sites based on that index.
    – Peteris
    Feb 13, 2016 at 5:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.