Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server.

It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have to input the FTP details manually for each update.

share|improve this question

1 Answer 1

I would consider it somewhat safe since that's where your database connection information is also stored. One could easily ruin your website by deleting your whole database if they had access to that file.

There are a couple of things you can do to increase security:

  1. Move the wp-config file one level outside the root. Wordpress knows to look for the file there.

  2. Make sure your server is hiding your root/parent index. That's an option you can usually change yourself in cpanel.

share|improve this answer
    
Thanks for your reply -- I was aware of those options. Of the couple of instances were rogue access was gained to a few of my sites it was down to other users' FTP credentials being compromised on the shared server. So I'm a little twitchy about hard coding them into a file but I suppose once a hacker had FTP access like that, it wouldn't make any difference. –  Dave McCourt Mar 10 at 18:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.