WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server.

It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have to input the FTP details manually for each update.

share|improve this question

I would consider it somewhat safe since that's where your database connection information is also stored. One could easily ruin your website by deleting your whole database if they had access to that file.

There are a couple of things you can do to increase security:

  1. Move the wp-config file one level outside the root. Wordpress knows to look for the file there.

  2. Make sure your server is hiding your root/parent index. That's an option you can usually change yourself in cpanel.

share|improve this answer
Thanks for your reply -- I was aware of those options. Of the couple of instances were rogue access was gained to a few of my sites it was down to other users' FTP credentials being compromised on the shared server. So I'm a little twitchy about hard coding them into a file but I suppose once a hacker had FTP access like that, it wouldn't make any difference. – Dave McCourt Mar 10 '14 at 18:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.