Tag Info

Hot answers tagged

38

Short answer: yes The answer to this question is an unequivocal yes, and to say otherwise is completely irresponsible. Long answer: a real-world example Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured. The bug: Take a look at this ...


27

Here is how I do it and I haven't come across anything better than this. I keep a different version of wp-config.php file under version control and then keep a file one directory above which holds all the database credentials and salts/keys. Also this way, I am able to distinguish between the type of setup I am running and do things differently on basis of ...


19

The biggest thing is the wp-config.php contains some sensitive information: your database username/password, etc. So the idea: move it outside the document root, and you don't have to worry about anything. An attacker will never be able to access that file from an external source. Here's the rub, however: wp-config.php never actually prints anything to the ...


17

I think Max's is a knowledgeable answer, and that's one side of the story. The WordPress Codex has more advise: Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission). If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing ...


13

Definitely YES. When you move wp-config.php outside public directory you protect it from reading using browser when php handler gets maliciously (or accidentally!) changed. Reading your DB login/password is possible when server is hardly infected through a fault of lame administrator. Charge the administrator a fine and get a better-tended and more ...


12

I don't think there is a universal URL hook. There are a lot of hooks and I may have missed it, but I don't think there is one. You can look through the hooks at adambrown.info. There are a lot of URL hooks, but not a universal one. If I may suggest another solution: Log the errors to a files. /** * This will log all errors notices and warnings to a file ...


12

The "Hardening WordPress" page of the Codex contains a section on "Securing wp-config.php". It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that. Of course there is some danger to having a file with the password like this if someone gets access to ...


9

Symbolic links are … risky in WordPress. It is easier to use a separate domain for plugins per wp-config.php: define( 'WP_PLUGIN_DIR', '/local/path/to/plugin/directory' ); define( 'WP_PLUGIN_URL', 'http://plugins.dev'); See Strategy On Building Plugin Using Eclipse as an example for IDE configuration with such a setup.


8

There is, as far as I know, no way to hook into wp-config.php from a Theme. For one, wp-config.php shouldn't be writeable; for another, wp-config.php is executed well-before a Theme's functions.php file is parsed. For a great overview of how WordPress boots, have a look at this two-part post by Theme.FM (part 1, part 2) or this Explanation with a flowchart ...


8

Even though my first approach was for the garbage bin and s_ha_dums answer is a clean, and probably the best, way of going about it, let me offer one more working scenario: The following sets a cookie that is valid for the next 24 hours (86400 seconds) when an administrator logs into the system. In wp-config.php, the constant WP_DEBUG is conditionally ...


7

How can I do this without exposing my passwords to git, in case this repository ever becomes public? If your wp-config.php file is in version control, then any passwords it contains will also be in version control. The only way to avoid that is to not put the file in version control. Is this too much trouble and should I just leave wp-config.php ...


7

Someone asked us to shine in, and I will reply here. Yes, there are security benefits from isolating your wp-config.php from the root directory of your site. 1- If your PHP handler gets broken or modified in some way, your DB information will not be exposed. And yes, I saw this happen a few times on shared hosts during server updates. Yes, the site will be ...


7

http://wordpress.org/extend/plugins/wordpress-beta-tester/ Sets you up for the nightlies, if that is what you are looking for. I've got it running on my dev install @ cdn.rvoodoo.com. Works great there


7

You don't really need to remove these files. It's much easier to just block access to them. If you are using pretty URL's you already have an .htaccess file. Using .htaccess to block the files is secure and you only have to add a directive once. Blocking files is done by adding a directive to .htaccess like this: <files filename.file-extension> ...


6

You can do the following: Set EMPTY_TRASH_DAYS to a very high number. E.g.: define( 'EMPTY_TRASH_DAYS', 1000000 ); Or remove the wp_schedule_delete action: function my_remove_schedule_delete() { remove_action( 'wp_scheduled_delete', 'wp_scheduled_delete' ); } add_action( 'init', 'my_remove_schedule_delete' );


6

Apparantly this happens with the newer version of domain mapping because sunrise.php itself needs to be updated. To solve it I: Copy the new sunrise.php file from wp-content/plugins/wordpress-mu-domain-mapping/sunrise.php to wp-content/sunrise.php and you'll be fine. And it works now.


6

I just want to clarify, for the sake of argument, that moving your wp_config.php file does not necessarily mean you have to move it only to the parent directory. Let's say you have a structure like /root/html, where html contains the WP installation and all of your HTML content. Instead of moving wp_config.php to /root, you could move it to something like ...


5

To make a case for keeping your config file one level up from the web root (as mrwweb suggested): a few months ago, an automatic update on a production server of ours killed php but left apache running. So everyone coming to the homepage was being offered index.php as a download. In theory, anybody who knew it was a WordPress site could have requested ...


4

Change the name of news.php to index.php. I don't know of any legitimate use case that exists for changing index.php. If something else is using index.php then move WP in its own /news directory. You could change the .htaccess but you might run into trouble down the road.


4

Pam, It sounds like you are facing some major challenges, but I would highly recommend not messing with the table prefix. Doing so will lead to a series of problems, which will require hack after hack to remedy leaving you with a substantial mess of a WordPress installation. There are some other things you can do to help solve issues with slow queries. ...


4

Hm, core WP files are usually die properly if opened directly. It probably slipped developers to include check in this one or something. The simple ways to fix this (and not really WP-specific) would be to: configure PHP on server to not display errors by default; restrict access to file with .htaccess or other means.


4

define('FS_METHOD', 'ftpext'); define('FTP_BASE', '/path/to/wordpress/'); define('FTP_CONTENT_DIR', '/path/to/wordpress/wp-content/'); define('FTP_PLUGIN_DIR ', '/path/to/wordpress/wp-content/plugins/'); define('FTP_PUBKEY', '/home/username/.ssh/id_rsa.pub'); define('FTP_PRIKEY', '/home/username/.ssh/id_rsa'); define('FTP_USER', 'username'); ...


4

You have probably added the definitions too late. If in fact you added that "to the end" of wp-config.php then you added it after these lines: /** Sets up WordPress vars and included files. */ require_once(ABSPATH . 'wp-settings.php'); If so, then those constants are already defined (wp_initial_constants) and you cannot redefine a constant after it is ...


4

I use Dropbox as well, but not directly linked as the Dropbox folder path could differ from install to install. My Dropbox just is the root of my bare git repository. Simplified... When I start coding, I just add a new folder to my Dropbox and --bare init it. // Inside your Dropbox/webdev/themes folder for e.g. git --bare init Then inside your new Theme ...


4

You can do this by adding some code to wp-config.php $request_uri = $_SERVER['REQUEST_URI']; $debug_dirs = array ('/debug-dir1/','/debug-dir2/'); // list of directories to turn on debugging foreach ($debug_dirs as $debug_dir) { if (!strncmp($request_uri,$debug_dir,strlen($debug_dir))) { define('WP_DEBUG', true); } } define('WP_DEBUG', ...


3

It turns out that all WP_DEBUG_LOG does is: ini_set( 'log_errors', 1 ); ini_set( 'error_log', WP_CONTENT_DIR . '/debug.log' ); So, if you want to change the log location for WP_DEBUG_LOG in a plugin or theme, webaware's answer is best. If you just want to have it changed within wp-config.php you can replace define( 'WP_DEBUG_LOG', true ); with the above 2 ...


3

I came up with this solution. This function checks in each directory level starting from the directory of the current file for the file wp-config.php. <?php function find_wp_config_path() { $dir = dirname(__FILE__); do { if( file_exists($dir."/wp-config.php") ) { return $dir; } } ...


3

This is how i set my content directory in wp-config.php // ======================== // Custom Content Directory // ======================== define( 'WP_CONTENT_DIR', dirname( __FILE__ ) . '/somedir' ); define( 'WP_CONTENT_URL', 'http://' . $_SERVER['HTTP_HOST'] . '/somedir' );


3

To disable WordPress Cron Jobs, place this in wp-config.php: define('DISABLE_WP_CRON', true); To schedule a cron job in Linux with cPanel for example... This is the command you might run: wget -q -O - http://www.your-domain.org/wp-cron.php?doing_wp_cron >/dev/null 2>&1 The end of the above command just suppresses any output. Just pick the ...


3

You don’t need a separate rule in your .htaccess. Add … define( 'WP_CONTENT_DIR', 'YOUR_LOCAL_PATH' ); define( 'WP_CONTENT_URL', 'YOUR_PUBLIC_PATH' ); … to your wp-config.php. Do not write into wp-settings.php. This file will be overwritten during the next update – never touch a core file.



Only top voted, non community-wiki answers of a minimum length are eligible