.htaccess file missing from fresh WordPress install?

[d19dotca]

I am troubleshooting an issue I have with one of my staging websites where redirects aren't working the way I wanted. Anyways long story short, I setup a brand new instance to try and compare some defaults, but I noticed there's no .htaccess file in a fresh WordPress Developer app deployment. Is this intentional? Shouldn't there be a .htaccess file in the /app/data/public/ directory?

[d19dotca]

Looks like it was created once I changed the permalink structure from the defaults. But shouldn't there still be an .htaccess the whole time for Apache?

[girish]

I think the WP distribution does not have .htaccess files at all and it's only generated when you setup permalinks. I thought maybe atleast wp-content might have .htaccess inside it but even that doesn't. I guess it's up to the user to set those up, if they want to.

I guess the main danger is if your site somehow allows someone to upload php files, then it might get executed under wp-content. But this of course requires one to install such a plugin that let's someone upload random files.