I am unfortunately responsible for maintaining a Wordpress installation. Since Wordpress and its plugins frequently have public security vulnerabilities, I'd like to disguise as much as possible which plugins we're using.
When requesting a URL like
mysite.com/wp-content/themes/theme/js/nivo-slider/themes/, Apache returns a
403 Forbidden. This tells an attacker that the path does, in fact, exist, since
mysite.com/wp-content/themes/themes/js/foobar returns a 404.
I've looked through the documentation, and I don't see any way to tell Apache to return a 404 instead of a 403. Is this possible without patching the source? Alternatively, is there another way to give 404s on these sorts of requests?