WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Considering the information that is in the wp-config file, how secure is this file? I have password salts in place, but can someone view this file? Or to what level of difficulty can some view the contents?

share|improve this question

This is really more of a server configuration question. By necessity, wp-config.php must be readable by WordPress itself, but file access/security beyond that is really a matter of how your server is configured.

share|improve this answer
Ok, but can some view into my wp-config and see the password for my db? – MartyMcFly May 16 '13 at 20:17
There is no definitive answer to that question. – Chip Bennett May 16 '13 at 21:47

This could be hacked if for example a bad plugin is installed and creates flaws. This could be hacked because of the CRSF flaw that is to say a hacker utilizes an approved user account to make bad things.

You could start with this in .htaccess:

<files wp-config.php>
order allow,deny
deny from all

But there is not an absolute protection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.