WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can I configure wordpress to use two database usernames, one to read (which has read-only permissions in the database) and one to post (who is hidden in a protected wp-admin directory) for security purposes?

The point is that even if someone hacks wordpress, they won't have permission to do any harm.

share|improve this question
Define "hacks WordPress". What situation would this protect against? – Milo Jun 14 '13 at 0:54
@Milo like an sql injection attack – stoppress Jun 14 '13 at 4:10
core inserts all use prepared statements. it's probably simpler to vet any plugins for unsafe queries. – Milo Jun 14 '13 at 4:44
@Milo what about select? – stoppress Jun 14 '13 at 6:20
any query that accepts input in core should be prepared. – Milo Jun 14 '13 at 6:30

WordPress does not allow this "configuration". And I seriously doubt you would have any luck writing a plugin that would take care of this in a complete way. The WPDB class is heavily utilized throughout the site, and sifting through read-only vs write-enabled uses would be daunting.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.