Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I read the following tutorial, which mentions moving your config file out of an HTTP-accessible folder.

http://codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php

I did this, and it works fine. And when I visit http://mysite.com/wp-config.php, I see a blank page, as expected. However, when I visit http://mysite.com/wp-settings.php, I receive the following error:

Warning: require(ABSPATHwp-includes/load.php) [function.require]: failed to open stream: No such file or directory in /home/{my user name}/mysite.com/wp-settings.php on line 19

Fatal error: require() [function.require]: Failed opening required 'ABSPATHwp-includes/load.php' (include_path='.:/usr/local/lib/php:/usr/local/php5/lib/pear') in /home/{my user name}/mysite.com/wp-settings.php on line 19

I'm new to WordPress and PHP, but not new to programming. Obviously, having my shell user's name output to the web if someone were to hit my wp-settings file is a no-no.

So, can you have your config file out of the web directory, as I have here, without files like wp-settings resulting in sensitive information leaked to the screen? Am I going about this all wrong?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Hm, core WP files are usually die properly if opened directly. It probably slipped developers to include check in this one or something.

The simple ways to fix this (and not really WP-specific) would be to:

  • configure PHP on server to not display errors by default;
  • restrict access to file with .htaccess or other means.
share|improve this answer
    
Thanks for the suggestions. If you don't mind my asking, do you use the paradigm in that article (moving your config out of a web directory)? If not, why not? –  Andy Mar 14 '11 at 20:07
    
@Andy if something fails or mis-configured server-side and wp-config.php is served as plain text file - it contains sensitive information like database credentials. Rest of the files are generic to WordPress and do not contain anything that might compromise your installation if their content is revealed. –  Rarst Mar 14 '11 at 20:43
    
@Rarst: Thank you. Should I be checking any other pages to be sure they die properly if accessed directly? –  Andy Mar 14 '11 at 20:46
1  
@Andy best approach is to configure your server to never output errors to visitors. That is just good practice and is really actual issue here. –  Rarst Mar 14 '11 at 20:57
    
I tried adding "php_flag display_errors off" to my htaccess file, but the settings page still outputs the error. I got it to redirect to 404 by adding a "deny from all" to htaccess, but I'm still worried that other pages might display errors. –  Andy Mar 14 '11 at 21:30
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.