Should I remove install.php and install-helper.php?

2 comments

1. No, there is no security risk. Both files do sanity checks before anything happens.

   If WordPress is already installed:

   • install-helper.php returns just a blank page.
   • install.php says WordPress is installed and you should log in:
     

   You can forbid access to both files with a simple rule in your .htaccess above the permalink rules:

   RedirectMatch Permanent wp-admin/install(-helper)?.php /
   

   This will redirect all requests to these files to the home page.

   Log in to Reply

2. # nginx configuration
   
   location ~ wp-admin/install(-helper)?.php {
       rewrite ^(.*)$ / redirect;
   }
   

   Log in to Reply