Hot answers tagged

68

Short answer: yes The answer to this question is an unequivocal yes, and to say otherwise is completely irresponsible. Long answer: a real-world example Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured. The bug: Take a look at this ...


38

Here is how I do it and I haven't come across anything better than this. I keep a different version of wp-config.php file under version control and then keep a file one directory above which holds all the database credentials and salts/keys. Also this way, I am able to distinguish between the type of setup I am running and do things differently on basis of ...


30

The biggest thing is the wp-config.php contains some sensitive information: your database username/password, etc. So the idea: move it outside the document root, and you don't have to worry about anything. An attacker will never be able to access that file from an external source. Here's the rub, however: wp-config.php never actually prints anything to the ...


18

I think Max's is a knowledgeable answer, and that's one side of the story. The WordPress Codex has more advise: Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission). If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing ...


14

I don't think there is a universal URL hook. There are a lot of hooks and I may have missed it, but I don't think there is one. You can look through the hooks at adambrown.info. There are a lot of URL hooks, but not a universal one. If I may suggest another solution: Log the errors to a files. /** * This will log all errors notices and warnings to a file ...


13

Definitely YES. When you move wp-config.php outside public directory you protect it from reading using browser when php handler gets maliciously (or accidentally!) changed. Reading your DB login/password is possible when server is hardly infected through a fault of lame administrator. Charge the administrator a fine and get a better-tended and more ...


12

You don't really need to remove these files. It's much easier to just block access to them. If you are using pretty URL's you already have an .htaccess file. Using .htaccess to block the files is secure and you only have to add a directive once. Blocking files is done by adding a directive to .htaccess like this: <files filename.file-extension> ...


12

The "Hardening WordPress" page of the Codex contains a section on "Securing wp-config.php". It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that. Of course there is some danger to having a file with the password like this if someone gets access to ...


11

Someone asked us to shine in, and I will reply here. Yes, there are security benefits from isolating your wp-config.php from the root directory of your site. 1- If your PHP handler gets broken or modified in some way, your DB information will not be exposed. And yes, I saw this happen a few times on shared hosts during server updates. Yes, the site will be ...


10

You can do the following: Set EMPTY_TRASH_DAYS to a very high number. E.g.: define( 'EMPTY_TRASH_DAYS', 1000000 ); Or remove the wp_schedule_delete action: function my_remove_schedule_delete() { remove_action( 'wp_scheduled_delete', 'wp_scheduled_delete' ); } add_action( 'init', 'my_remove_schedule_delete' );


10

Symbolic links are … risky in WordPress. It is easier to use a separate domain for plugins per wp-config.php: define( 'WP_PLUGIN_DIR', '/local/path/to/plugin/directory' ); define( 'WP_PLUGIN_URL', 'http://plugins.dev'); See Strategy On Building Plugin Using Eclipse as an example for IDE configuration with such a setup.


9

There is, as far as I know, no way to hook into wp-config.php from a Theme. For one, wp-config.php shouldn't be writeable; for another, wp-config.php is executed well-before a Theme's functions.php file is parsed. For a great overview of how WordPress boots, have a look at this two-part post by Theme.FM (part 1, part 2) or this Explanation with a flowchart ...


9

How can I do this without exposing my passwords to git, in case this repository ever becomes public? If your wp-config.php file is in version control, then any passwords it contains will also be in version control. The only way to avoid that is to not put the file in version control. Is this too much trouble and should I just leave wp-config.php ...


9

localhost refers to the machine it's running on. For example on my own site tomjn.com localhost is 127.0.0.1 as it always is. This doesn't mean the hacker doesn't know where to connect, it means the hacker replaces localhost with tomjn.com. Of course if I have a proxy sitting in front this won't work, but keep in mind that if the attacker has access to my ...


8

Even though my first approach was for the garbage bin and s_ha_dums answer is a clean, and probably the best, way of going about it, let me offer one more working scenario: The following sets a cookie that is valid for the next 24 hours (86400 seconds) when an administrator logs into the system. In wp-config.php, the constant WP_DEBUG is conditionally ...


7

http://wordpress.org/extend/plugins/wordpress-beta-tester/ Sets you up for the nightlies, if that is what you are looking for. I've got it running on my dev install @ cdn.rvoodoo.com. Works great there


7

Using the defines the user sets in wp-config: mysql_connect(DB_HOST, DB_USER, DB_PASSWORD); EDIT: Since your script is outside the Wordpress environment, what you want to do is initiate it before using the defines in wp-config. require_once(path/to/wp-config.php'); mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);


7

It turns out that all WP_DEBUG_LOG does is: ini_set( 'log_errors', 1 ); ini_set( 'error_log', WP_CONTENT_DIR . '/debug.log' ); So, if you want to change the log location for WP_DEBUG_LOG in a plugin or theme, webaware's answer is best. If you just want to have it changed within wp-config.php you can replace define( 'WP_DEBUG_LOG', true ); with the above 2 ...


7

You have probably added the definitions too late. If in fact you added that "to the end" of wp-config.php then you added it after these lines: /** Sets up WordPress vars and included files. */ require_once(ABSPATH . 'wp-settings.php'); If so, then those constants are already defined (wp_initial_constants) and you cannot redefine a constant after it is ...


6

Apparantly this happens with the newer version of domain mapping because sunrise.php itself needs to be updated. To solve it I: Copy the new sunrise.php file from wp-content/plugins/wordpress-mu-domain-mapping/sunrise.php to wp-content/sunrise.php and you'll be fine. And it works now.


6

I just want to clarify, for the sake of argument, that moving your wp_config.php file does not necessarily mean you have to move it only to the parent directory. Let's say you have a structure like /root/html, where html contains the WP installation and all of your HTML content. Instead of moving wp_config.php to /root, you could move it to something like /...


5

To make a case for keeping your config file one level up from the web root (as mrwweb suggested): a few months ago, an automatic update on a production server of ours killed php but left apache running. So everyone coming to the homepage was being offered index.php as a download. In theory, anybody who knew it was a WordPress site could have requested wp-...


5

The best way is to not do that. There's no need for a plugin file to ever include the wp-config.php. You're doing it backwards. WordPress loads plugins. Plugins don't load WordPress.


5

This is just, how I understood the idea of the WordPress File API. If it is wrong, please downvote :) Okay. If you upload a file, this file has an owner. If you upload your file with FTP, you login and the file will be owned by the FTP user. Since you have the credentials, you can alter these files through FTP. The owner can usually execute, delete, alter ...


4

Hm, core WP files are usually die properly if opened directly. It probably slipped developers to include check in this one or something. The simple ways to fix this (and not really WP-specific) would be to: configure PHP on server to not display errors by default; restrict access to file with .htaccess or other means.


4

After spending the entire day working on this, I finally found a guide that worked perfectly: http://www.blogsuccessjournal.com/blog-tips-and-advice/wordpress-tips-advice/seeing-weird-characters-on-blog-how-to-fix-wordpress-character-encoding-latin1-to-utf8/ Before that, I tried following @Rarst's information, tried exporting the database and manually ...


4

define('FS_METHOD', 'ftpext'); define('FTP_BASE', '/path/to/wordpress/'); define('FTP_CONTENT_DIR', '/path/to/wordpress/wp-content/'); define('FTP_PLUGIN_DIR ', '/path/to/wordpress/wp-content/plugins/'); define('FTP_PUBKEY', '/home/username/.ssh/id_rsa.pub'); define('FTP_PRIKEY', '/home/username/.ssh/id_rsa'); define('FTP_USER', 'username'); define('FTP_PASS'...


4

I came up with this solution. This function checks in each directory level starting from the directory of the current file for the file wp-config.php. <?php function find_wp_config_path() { $dir = dirname(__FILE__); do { if( file_exists($dir."/wp-config.php") ) { return $dir; } } while(...


4

Mark's example assumes you are working with a private repo: if ( file_exists( dirname( __FILE__ ) . '/local-config.php' ) ) { include( dirname( __FILE__ ) . '/local-config.php' ); define( 'WP_LOCAL_DEV', true ); } else { define( 'DB_NAME', 'production_db' ); define( 'DB_USER', 'production_user' ); define( 'DB_PASSWORD', '...


4

Change the name of news.php to index.php. I don't know of any legitimate use case that exists for changing index.php. If something else is using index.php then move WP in its own /news directory. You could change the .htaccess but you might run into trouble down the road.



Only top voted, non community-wiki answers of a minimum length are eligible