Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Considering the information that is in the wp-config file, how secure is this file? I have password salts in place, but can someone view this file? Or to what level of difficulty can some view the contents?

share|improve this question

2 Answers 2

This could be hacked if for example a bad plugin is installed and creates flaws. This could be hacked because of the CRSF flaw that is to say a hacker utilizes an approved user account to make bad things.

You could start with this in .htaccess:

<files wp-config.php>
order allow,deny
deny from all
</files>

But there is not an absolute protection.

share|improve this answer

This is really more of a server configuration question. By necessity, wp-config.php must be readable by WordPress itself, but file access/security beyond that is really a matter of how your server is configured.

share|improve this answer
    
Ok, but can some view into my wp-config and see the password for my db? –  MartyMcFly May 16 '13 at 20:17
    
There is no definitive answer to that question. –  Chip Bennett May 16 '13 at 21:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.