Search code examples
wordpresssecurity

How to deny direct access to wp-cron.php to avoid attacks?

I've noticed some recent activity on one of my sites - it appears someone is directly calling the wp-cron.php file:

AWStats

The only reason I can think someone would be doing that is an attempt to overload the server, right? My question is this - is there any way to prevent it from being called directly?

I know you can disable wp-cron.php being called every page load like this:

define('DISABLE_WP_CRON', true);

but is there a way to prevent is being called directly? Is it something I should even be worried about?

Solution

  • As long as you don't have any big tasks in your cron there is nothing to worry about.

    If you disable it then what the "attacker" could do is to simply try accessing other file.I can bet that hitting your site directly will make much bigger load on your server than this run of wp-cron.php alone ;)

    Especially that wp-cron is being run as well when the page is getting loaded in a regular way (so load from it is "included" in regular traffic anyway).