What's blocked on Templ

For security reasons, Templ blocks web access to certain files and paths. The files stay on the server - only requests from the web are refused.

Blocked files and paths

These files and paths are blocked by default.

wp-config.php and variations

wp-config.php
wp-config.php.*
wp-config-sample.php

PHP files in the uploads folder

wp-content/uploads/*.php

To block PHP in additional paths, see Block PHP in paths.

Backup and temporary-file extensions

*.bak
*.old
*.orig
*.original
*.php#
*.php~
*.php_bak
*.save
*.swo
*.swp
*.sql
*.imported

Log files

*.log
*.log.x (where x is a number)
*.log.x.gz (where x is a number)

Optional blocks

Some blocks are off by default and can be turned on per site under Website → Advanced → Site Options.

WordPress's xmlrpc.php is a common target for brute-force attacks and denial-of-service amplification via pingbacks. If you don't rely on it, enable Block XML-RPC to return a 403 for any request to it.

The block matches any file named xmlrpc.php, wherever it lives - including subdirectory installs such as Bedrock, where the file is served at /wp/xmlrpc.php, not just /xmlrpc.php at the root.

Blocking XML-RPC breaks anything that talks to your site over it, such as the WordPress mobile app and some Jetpack features. If you use those, leave this off.

Block PHP in paths

Block PHP in paths blocks all web requests to .php files under the paths you list. One path per line; paths may be regular expressions, e.g. /app/uploads/.

Use it to prevent PHP execution in directories that should only hold uploads or static files: if an attacker plants a PHP file there, it can't be run over the web. Typical case: Bedrock sites, where uploads live under /app/uploads/ instead of wp-content/uploads.

WordPress still runs PHP normally. Only direct requests to .php files under the listed paths are blocked.
wp-content/uploads is always blocked. Your paths add to that default.

If you need access to a blocked file

The files themselves are still on the server - only web access to them is blocked. You can always read or download them over SFTP/SSH.

If your site legitimately needs one of these paths to be reachable from the web, contact support and we'll look at your use case.