How important is admin-ajax.php?

[Muhammad-Isap]

Hi there!

It's been a long time since I last did a technical audit of a site. I've currently playing with the 'fetch as google' tool to find out if we're blocking anything vital.

The site is based on Wordpress, and after a recent hacking incident, a previous SEO moved the login portal from domain.com/wp-admin/ to domain.com/pr3ss/wp-admin/ - to stop people finding it.

Fair enough. But they then updated the robots.txt file to look like this:

User-agent: *
Disallow: /pr3ss/wp-admin/

Now, some pages are trying to draw on theme elements like:

http://www.domain.com/pr3ss/wp-admin/admin-ajax.php
http://www.domain.com/pr3ss/wp-content/themes/bestpracticegroup/images/column_wrapper_bg.png

And are naturally being blocked (not that this seems to affect the way pages are rendering in Google's eyes)

A good SEO friend of mine has suggested allowing the theme folder, and any sub folders where this becomes an issue.

What are your thoughts? Is it even worth disallowing the /pr3ss/wp-admin/ path?

Cheers guys and gals!

All the best,

John.

I've found a couple of the theme's

[J-S]

On a side note, if you don't want hackers to find the wp-admin folder, you may not want to put the folder in the robots.txt file, as this is publicly accessible and it will make it easy to find (although it may not be an issue for automatic attacks).

[Everett]

Hello John,

I don't understand how blocking /wp-admin/ would keep /wp-content/ from being accessed and rendered by Google.

Google doesn't need to see anything in the /wp-admin/ folder so you should keep it blocked. They do need to see the /wp-content/ folder though.

[LesleyPaone]

It is either or really. Its not hard to tell that a site is running wordpress, it is pretty hard to hide. At the same time the admin directory does not have any public facing files for non-logged in users as well. I just use a good Wordpress security plugin, good server practices and leave it at that.