WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know a lot of Wordpress yet, and I'm just wondering:

Before installation you have to fill in the correct data in wp-config-sample.php but this also includes the database password. Isn't that dangerous? I mean, can some one explain how this is protected from just reading the file and thus getting the password of your DB?

share|improve this question
up vote 12 down vote accepted

The "Hardening WordPress" page of the Codex contains a section on "Securing wp-config.php". It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that.

Of course there is some danger to having a file with the password like this if someone gets access to your server, but, honestly, at that point they already are in your server.

Finally, you don't have much of a choice. I've never seen an alternate means of configuring WordPress. You can lock it down as much as you can, but this is how WordPress is built, and if it were a serious security threat, they wouldn't do it that way.

share|improve this answer
Thanks for that link! I can see a lot of security precautions there. Should one apply all of them? Or isn't anything of that really necessary? – Bram Vanroy May 29 '12 at 16:59
I don't know that one can ever have too much [well-implemented] security. – mrwweb May 29 '12 at 17:49
@mrwweb +1 for wellimplemented*. – Richard May 29 '12 at 20:16

To make a case for keeping your config file one level up from the web root (as mrwweb suggested): a few months ago, an automatic update on a production server of ours killed php but left apache running. So everyone coming to the homepage was being offered index.php as a download. In theory, anybody who knew it was a WordPress site could have requested wp-config.php, and gotten it (had it been in the web root). Of course, they'd only be able to use those DB credentials if we allowed remote MySQL connections--but still, not cool. I realize this is a fringe case, but it's so easy to keep your config out of sight, why not do it?

share|improve this answer

Unless someone has access via FTP, you don't need to worry about this. PHP is rendered on the server before it hit's the users browser.

share|improve this answer

If somebody has access to read the contents of your Php files, you've already been hacked.

share|improve this answer
or the web server's config got seriously borked to the point of just serving .php files as text ;-) – KJH May 9 at 17:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.