WordPress utilizes a file called wp-config. php to keep some essential setup settings. This file consists of to name a few things, your database username and password. So it is essential for the security of your site that no one will have access to the contents of that file.
The setup file (wp-config. php) is by default situated in the root directory site however under typical situations it’s contents are not openly available. If you attempt to access it through a web browser you will see that it does not produce any output.
A typical recommendation is to move wp-config.php one directory above the root directory for security factors. If WordPress is set up in the public_html directory, this in the majority of servers implies that you will need to move it to the /home/username/ directory on your server.
If no one can check out the contents of that file then why bother protect it?
Because of how much damage not protecting it can do. The reason to secure your wp-config.php file is for the uncommon instances when your hosting server’s PHP handler breaks or gets hacked and it’s content ends up being available to the general public.
In this instance everyone who wishes to will have access to your WordPress database details just by pointing their web browser to your wp-config.php file.
Why the idea of moving wp-config is not a great concept
-
- The only method for somebody to see the wp-config. php is by bypassing the server’s PHP interpreter. If that occurs you remain in difficulty anyway. It indicates that your server is hacked and the aggressor will have total administrative control of your website. Therefore anywhere you move wp-config.php to will still be visible.
-
- The majority of hosts utilise open_basedir security which indicates that if a php script attempts to open a file, the file location is examined and if it is outside the root directory defined by open_basedir it will not open. So if a hacker succeeds in injecting a destructive php script on your website it will provide him access to just this particular directory. Moving your wp-conig.php file above the root directory indicates that you need to broaden the open_basedir scope to let PHP gain access to scripts outside the web root.
- You can secure wp-config.php by utilising htaccess guidelines to reject HTTP demands to it. That method lets you attain the exact same level of security without the need to move the file and without broadening open_basedir. Simply include the following code in your the.htaccess file:
- << files wp-config. php>>
order permit, reject
reject from all
<
Will protecting wp-config.php make your WordPress site 100% secure? Definitely not. However it’s another security procedure that may prevent your site being hacked
