Hot answers tagged

67

Short answer: yes The answer to this question is an unequivocal yes, and to say otherwise is completely irresponsible. Long answer: a real-world example Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured. The bug: Take a look at this ...


37

Here is how I do it and I haven't come across anything better than this. I keep a different version of wp-config.php file under version control and then keep a file one directory above which holds all the database credentials and salts/keys. Also this way, I am able to distinguish between the type of setup I am running and do things differently on basis of ...


28

The biggest thing is the wp-config.php contains some sensitive information: your database username/password, etc. So the idea: move it outside the document root, and you don't have to worry about anything. An attacker will never be able to access that file from an external source. Here's the rub, however: wp-config.php never actually prints anything to the ...


18

I think Max's is a knowledgeable answer, and that's one side of the story. The WordPress Codex has more advise: Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission). If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing ...


14

I don't think there is a universal URL hook. There are a lot of hooks and I may have missed it, but I don't think there is one. You can look through the hooks at adambrown.info. There are a lot of URL hooks, but not a universal one. If I may suggest another solution: Log the errors to a files. /** * This will log all errors notices and warnings to a file ...


13

Definitely YES. When you move wp-config.php outside public directory you protect it from reading using browser when php handler gets maliciously (or accidentally!) changed. Reading your DB login/password is possible when server is hardly infected through a fault of lame administrator. Charge the administrator a fine and get a better-tended and more ...


12

The "Hardening WordPress" page of the Codex contains a section on "Securing wp-config.php". It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that. Of course there is some danger to having a file with the password like this if someone gets access to ...


11

Someone asked us to shine in, and I will reply here. Yes, there are security benefits from isolating your wp-config.php from the root directory of your site. 1- If your PHP handler gets broken or modified in some way, your DB information will not be exposed. And yes, I saw this happen a few times on shared hosts during server updates. Yes, the site will be ...


11

You don't really need to remove these files. It's much easier to just block access to them. If you are using pretty URL's you already have an .htaccess file. Using .htaccess to block the files is secure and you only have to add a directive once. Blocking files is done by adding a directive to .htaccess like this: <files filename.file-extension> ...


10

You can do the following: Set EMPTY_TRASH_DAYS to a very high number. E.g.: define( 'EMPTY_TRASH_DAYS', 1000000 ); Or remove the wp_schedule_delete action: function my_remove_schedule_delete() { remove_action( 'wp_scheduled_delete', 'wp_scheduled_delete' ); } add_action( 'init', 'my_remove_schedule_delete' );


10

Symbolic links are … risky in WordPress. It is easier to use a separate domain for plugins per wp-config.php: define( 'WP_PLUGIN_DIR', '/local/path/to/plugin/directory' ); define( 'WP_PLUGIN_URL', 'http://plugins.dev'); See Strategy On Building Plugin Using Eclipse as an example for IDE configuration with such a setup.


9

There is, as far as I know, no way to hook into wp-config.php from a Theme. For one, wp-config.php shouldn't be writeable; for another, wp-config.php is executed well-before a Theme's functions.php file is parsed. For a great overview of how WordPress boots, have a look at this two-part post by Theme.FM (part 1, part 2) or this Explanation with a flowchart ...


9

How can I do this without exposing my passwords to git, in case this repository ever becomes public? If your wp-config.php file is in version control, then any passwords it contains will also be in version control. The only way to avoid that is to not put the file in version control. Is this too much trouble and should I just leave wp-config.php ...


9

localhost refers to the machine it's running on. For example on my own site tomjn.com localhost is 127.0.0.1 as it always is. This doesn't mean the hacker doesn't know where to connect, it means the hacker replaces localhost with tomjn.com. Of course if I have a proxy sitting in front this won't work, but keep in mind that if the attacker has access to my ...


8

Even though my first approach was for the garbage bin and s_ha_dums answer is a clean, and probably the best, way of going about it, let me offer one more working scenario: The following sets a cookie that is valid for the next 24 hours (86400 seconds) when an administrator logs into the system. In wp-config.php, the constant WP_DEBUG is conditionally ...


7

Using the defines the user sets in wp-config: mysql_connect(DB_HOST, DB_USER, DB_PASSWORD); EDIT: Since your script is outside the Wordpress environment, what you want to do is initiate it before using the defines in wp-config. require_once(path/to/wp-config.php'); mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);


7

http://wordpress.org/extend/plugins/wordpress-beta-tester/ Sets you up for the nightlies, if that is what you are looking for. I've got it running on my dev install @ cdn.rvoodoo.com. Works great there


7

It turns out that all WP_DEBUG_LOG does is: ini_set( 'log_errors', 1 ); ini_set( 'error_log', WP_CONTENT_DIR . '/debug.log' ); So, if you want to change the log location for WP_DEBUG_LOG in a plugin or theme, webaware's answer is best. If you just want to have it changed within wp-config.php you can replace define( 'WP_DEBUG_LOG', true ); with the above 2 ...


7

You have probably added the definitions too late. If in fact you added that "to the end" of wp-config.php then you added it after these lines: /** Sets up WordPress vars and included files. */ require_once(ABSPATH . 'wp-settings.php'); If so, then those constants are already defined (wp_initial_constants) and you cannot redefine a constant after it is ...


6

Apparantly this happens with the newer version of domain mapping because sunrise.php itself needs to be updated. To solve it I: Copy the new sunrise.php file from wp-content/plugins/wordpress-mu-domain-mapping/sunrise.php to wp-content/sunrise.php and you'll be fine. And it works now.


6

I just want to clarify, for the sake of argument, that moving your wp_config.php file does not necessarily mean you have to move it only to the parent directory. Let's say you have a structure like /root/html, where html contains the WP installation and all of your HTML content. Instead of moving wp_config.php to /root, you could move it to something like ...


5

To make a case for keeping your config file one level up from the web root (as mrwweb suggested): a few months ago, an automatic update on a production server of ours killed php but left apache running. So everyone coming to the homepage was being offered index.php as a download. In theory, anybody who knew it was a WordPress site could have requested ...


5

The best way is to not do that. There's no need for a plugin file to ever include the wp-config.php. You're doing it backwards. WordPress loads plugins. Plugins don't load WordPress.


4

try to use get_temp_dir() to see if wordpress is using your WP_TEMP_DIR constant. i've tried this code in wp-config.php and it works define('WP_TEMP_DIR', dirname(__FILE__) . '/wp-content/temp/'); but you have to put it before the /* That's all, stop editing! Happy blogging. */ in your wp-config.php file.


4

You can do this by adding some code to wp-config.php $request_uri = $_SERVER['REQUEST_URI']; $debug_dirs = array ('/debug-dir1/','/debug-dir2/'); // list of directories to turn on debugging foreach ($debug_dirs as $debug_dir) { if (!strncmp($request_uri,$debug_dir,strlen($debug_dir))) { define('WP_DEBUG', true); } } define('WP_DEBUG', ...


4

When WP_DEBUG is set, WordPress sets (via wp_debug_mode() call early in core load process) the error reporting level to E_ALL & ~E_DEPRECATED & ~E_STRICT. This means all warnings and errors except strict errors and PHP deprecated functions (not WordPress ones). You can define your own level in a custom mu-plugin (the override needs to be called as ...


4

I use Dropbox as well, but not directly linked as the Dropbox folder path could differ from install to install. My Dropbox just is the root of my bare git repository. Simplified... When I start coding, I just add a new folder to my Dropbox and --bare init it. // Inside your Dropbox/webdev/themes folder for e.g. git --bare init Then inside your new Theme ...


4

I came up with this solution. This function checks in each directory level starting from the directory of the current file for the file wp-config.php. <?php function find_wp_config_path() { $dir = dirname(__FILE__); do { if( file_exists($dir."/wp-config.php") ) { return $dir; } } ...


4

When WordPress loads multisite, it includes the relevant MS specific files in wp-settings.php The relevant lines: <?php // Initialize multisite if enabled. if ( is_multisite() ) { require( ABSPATH . WPINC . '/ms-blogs.php' ); require( ABSPATH . WPINC . '/ms-settings.php' ); } elseif ( ! defined( 'MULTISITE' ) ) { define( 'MULTISITE', false ...


4

Change the name of news.php to index.php. I don't know of any legitimate use case that exists for changing index.php. If something else is using index.php then move WP in its own /news directory. You could change the .htaccess but you might run into trouble down the road.



Only top voted, non community-wiki answers of a minimum length are eligible