Most web attacks target the front door - login pages, form submissions, publicly exposed scripts. Directory traversal attacks are different. They exploit the way web servers navigate the file system, using the server itself to read files that were never meant to be accessible from the internet.
Understanding this attack helps you defend against it, even if you are not a developer.
How Directory Traversal Works
Your web server has a root directory - usually called public_html or www - that contains all the files visible to the internet. Everything outside that directory is supposed to be inaccessible to web visitors.
A directory traversal attack uses sequences like ../ (two dots and a slash) in URLs or form inputs to navigate up out of the web root. In a file system, ../ means "go up one directory." Chaining several of them together lets an attacker navigate to the system root and then to any file on the server.
A vulnerable URL might look like:
https://example.com/view?file=../../../etc/passwd
If the web application blindly uses the file parameter to read and display a file, it would read /etc/passwd - a file containing user account information from the operating system - instead of a file inside the web root.
Why It Is Serious
The most sensitive file on a WordPress installation is wp-config.php. It sits in the WordPress root directory (just outside public_html in a properly configured setup, or inside it in many default installations) and contains your database name, username, and password in plain text. A successful directory traversal attack can expose these credentials.
Other targets include server configuration files, PHP configuration files (php.ini), .env files containing API keys, and log files that reveal server paths and application behaviour.
With database credentials, an attacker can access your entire database: customer records, order history, hashed passwords, email addresses. The potential impact is serious enough that directory traversal is included in the OWASP Top 10 list of critical web application security risks.
How to Check if Directory Listing Is Enabled
Directory listing is a related issue. When enabled, navigating to a folder on your site (like https://yoursite.ca/images/) displays a list of all files in that directory instead of returning an error. This is not directory traversal, but it gives attackers a map of your file structure.
Test it yourself: visit https://yoursite.ca/wp-content/uploads/ in a browser. If you see a list of files and folders, directory listing is enabled and should be turned off.
How to Prevent Directory Traversal
Disable directory listing in .htaccess: Add the following line to your site's .htaccess file (in your public_html root):
Options -Indexes
This prevents the server from displaying directory contents when no index file is present.
Validate file path inputs in PHP: Any PHP code that accepts a filename from user input and reads a file should validate that the resolved path is within the intended directory. The realpath() function returns the absolute path after resolving ../ sequences. Compare the result against the expected directory and reject anything that falls outside it.
Set correct file permissions: WordPress files should generally be 644 (readable by the server, not writable by others) and directories 755. Sensitive files like wp-config.php can be set to 600. Restrictive permissions limit what an attacker can do even if they find a vulnerability.
Use a Web Application Firewall (WAF): A WAF inspects incoming requests and blocks known attack patterns including directory traversal sequences. Cloudflare's free plan includes basic WAF rules. Wordfence for WordPress also includes WAF functionality.
Keep software updated: Directory traversal vulnerabilities in WordPress plugins are patched regularly. An out-of-date plugin is an unpatched vulnerability. Keeping plugins, themes, and WordPress core updated is the single most effective thing you can do to reduce your attack surface.
Checking for directory listing takes 30 seconds. Fixing it takes one line of code. That is an excellent return on investment for a meaningful security improvement.
