Suggestion: Restrict additional files in DENY BROWSER ACCESS TO THESE FILES

[wpconvert]

Hi.
I’ve been getting a number of these kinds of error in my server error log recently:

[18-Jul-2026 20:36:09 UTC] PHP Fatal error: Uncaught Error: Undefined constant "ABSPATH" in /home/mydomain/public_html/wp-settings.php:34 Stack trace: #0 {main} thrown in /home/mydomain/public_html/wp-settings.php on line 34

This has occurred after updating wordpress (although that could be coincidence of course as I’ve had them outside of this too). It seems like bot scans on the wordpress installation soon after update.

Anyway, my suggestion would be to tighten browser accessible files a bit further to include wp-settings.php and wp-load.php – these files do not need to be accessed via http and adding them to the DENY BROWSER ACCESS TO THESE FILES section would alleviate any annoying error log entries and further reduce any “attack surface”.

Obviously, and quite simply, modifying the filesmatch statement to read:
<FilesMatch "^(wp-config\.php|wp-settings\.php|wp-load\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)">
does the trick

What I now have in my Custom Code/DENY BROWSER ACCESS TO THESE FILES then is this:

# DENY BROWSER ACCESS TO THESE FILES
# Use BPS Custom Code to modify/edit/change this code and to save it permanently.
# wp-config.php, bb-config.php, php.ini, php5.ini, readme.html
# To be able to view these files from a Browser, replace 127.0.0.1 with your actual
# current IP address. Comment out: #Require all denied and Uncomment: Require ip 127.0.0.1
# Comment out: #Deny from all and Uncomment: Allow from 127.0.0.1
# Note: The BPS System Info page displays which modules are loaded on your server.

<FilesMatch "^(wp-config\.php|wp-settings\.php|wp-load\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)">
<IfModule mod_authz_core.c>
Require all denied
#Require ip 127.0.0.1
</IfModule>

<IfModule !mod_authz_core.c>
<IfModule mod_access_compat.c>
Order Allow,Deny
Deny from all
#Allow from 127.0.0.1
</IfModule>
</IfModule>
</FilesMatch>

Not any kind of major fix clearly – it just does away with a few php fatals in the error log for sure as they get 403’d straight away. I’ll reiterate again – BPS Pro continues to be top of my list when building a WordPress site – a must have. Thanks again.

[AITpro Admin]

Yep, I have seen that error before when updating WordPress. It is caused by a delay/latency in the WordPress update process. What the error means is that the constant “ABSPATH” is not seen as loaded yet. This error can also be caused by intermittent server load issues. ie if your server is briefly overloaded then dependent files may not load in time for dependencies used on other WP files. Intermittent PHP errors are ok and will happen from time to time. So you can just ignore them. If a PHP error is constantly or permanently occurring then you have a problem that needs to be fixed on your website.

[wpconvert]

Ahh I see – ok. I just automatically associated it with a bot probe when I matched up the server log entries with php errors I was getting on a number of sites –  as I haven’t seen this error before.

I’m quite confident that it wouldn’t be anything related to server load – I have very decent resources.

There is no harm in adding wp-settings.php and wp-load.php to the restricted browser file statement anyway 🙂

Thanks for taking the time to respond.

[Author]

Posts