Tag Info

Hot answers tagged

31

Short answer: yes The answer to this question is an unequivocal yes, and to say otherwise is completely irresponsible. Long answer: a real-world example Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured. The bug: Take a look at this ...


26

Here is how I do it and I haven't come across anything better than this. I keep a different version of wp-config.php file under version control and then keep a file one directory above which holds all the database credentials and salts/keys. Also this way, I am able to distinguish between the type of setup I am running and do things differently on basis of ...


17

I think Max's is a knowledgeable answer, and that's one side of the story. The WordPress Codex has more advise: Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission). If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing ...


15

The biggest thing is the wp-config.php contains some sensitive information: your database username/password, etc. So the idea: move it outside the document root, and you don't have to worry about anything. An attacker will never be able to access that file from an external source. Here's the rub, however: wp-config.php never actually prints anything to the ...


13

Definitely YES. When you move wp-config.php outside public directory you protect it from reading using browser when php handler gets maliciously (or accidentally!) changed. Reading your DB login/password is possible when server is hardly infected through a fault of lame administrator. Charge the administrator a fine and get a better-tended and more ...


12

I don't think there is a universal URL hook. There are a lot of hooks and I may have missed it, but I don't think there is one. You can look through the hooks at adambrown.info. There are a lot of URL hooks, but not a universal one. If I may suggest another solution: Log the errors to a files. /** * This will log all errors notices and warnings to a file ...


12

The "Hardening WordPress" page of the Codex contains a section on "Securing wp-config.php". It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that. Of course there is some danger to having a file with the password like this if someone gets access to ...


9

Symbolic links are … risky in WordPress. It is easier to use a separate domain for plugins per wp-config.php: define( 'WP_PLUGIN_DIR', '/local/path/to/plugin/directory' ); define( 'WP_PLUGIN_URL', 'http://plugins.dev'); See Strategy On Building Plugin Using Eclipse as an example for IDE configuration with such a setup.


8

There is, as far as I know, no way to hook into wp-config.php from a Theme. For one, wp-config.php shouldn't be writeable; for another, wp-config.php is executed well-before a Theme's functions.php file is parsed. For a great overview of how WordPress boots, have a look at this two-part post by Theme.FM (part 1, part 2) or this Explanation with a flowchart ...


7

How can I do this without exposing my passwords to git, in case this repository ever becomes public? If your wp-config.php file is in version control, then any passwords it contains will also be in version control. The only way to avoid that is to not put the file in version control. Is this too much trouble and should I just leave wp-config.php ...


7

http://wordpress.org/extend/plugins/wordpress-beta-tester/ Sets you up for the nightlies, if that is what you are looking for. I've got it running on my dev install @ cdn.rvoodoo.com. Works great there


7

You don't really need to remove these files. It's much easier to just block access to them. If you are using pretty URL's you already have an .htaccess file. Using .htaccess to block the files is secure and you only have to add a directive once. Blocking files is done by adding a directive to .htaccess like this: <files filename.file-extension> ...


7

Even though my first approach was for the garbage bin and s_ha_dums answer is a clean, and probably the best, way of going about it, let me offer one more working scenario, for the sake of completeness: functions.php: function wpse_69549_admin_debug( $user_login, $user ) { if ( in_array( 'administrator', $user->roles ) ) { setcookie( ...


7

Someone asked us to shine in, and I will reply here. Yes, there are security benefits from isolating your wp-config.php from the root directory of your site. 1- If your PHP handler gets broken or modified in some way, your DB information will not be exposed. And yes, I saw this happen a few times on shared hosts during server updates. Yes, the site will be ...


6

I just want to clarify, for the sake of argument, that moving your wp_config.php file does not necessarily mean you have to move it only to the parent directory. Let's say you have a structure like /root/html, where html contains the WP installation and all of your HTML content. Instead of moving wp_config.php to /root, you could move it to something like ...


6

Apparantly this happens with the newer version of domain mapping because sunrise.php itself needs to be updated. To solve it I: Copy the new sunrise.php file from wp-content/plugins/wordpress-mu-domain-mapping/sunrise.php to wp-content/sunrise.php and you'll be fine. And it works now.


6

You can do the following: Set EMPTY_TRASH_DAYS to a very high number. E.g.: define( 'EMPTY_TRASH_DAYS', 1000000 ); Or remove the wp_schedule_delete action: function my_remove_schedule_delete() { remove_action( 'wp_scheduled_delete', 'wp_scheduled_delete' ); } add_action( 'init', 'my_remove_schedule_delete' );


4

Hm, core WP files are usually die properly if opened directly. It probably slipped developers to include check in this one or something. The simple ways to fix this (and not really WP-specific) would be to: configure PHP on server to not display errors by default; restrict access to file with .htaccess or other means.


4

To make a case for keeping your config file one level up from the web root (as mrwweb suggested): a few months ago, an automatic update on a production server of ours killed php but left apache running. So everyone coming to the homepage was being offered index.php as a download. In theory, anybody who knew it was a WordPress site could have requested ...


4

define('FS_METHOD', 'ftpext'); define('FTP_BASE', '/path/to/wordpress/'); define('FTP_CONTENT_DIR', '/path/to/wordpress/wp-content/'); define('FTP_PLUGIN_DIR ', '/path/to/wordpress/wp-content/plugins/'); define('FTP_PUBKEY', '/home/username/.ssh/id_rsa.pub'); define('FTP_PRIKEY', '/home/username/.ssh/id_rsa'); define('FTP_USER', 'username'); ...


4

Change the name of news.php to index.php. I don't know of any legitimate use case that exists for changing index.php. If something else is using index.php then move WP in its own /news directory. You could change the .htaccess but you might run into trouble down the road.


4

Pam, It sounds like you are facing some major challenges, but I would highly recommend not messing with the table prefix. Doing so will lead to a series of problems, which will require hack after hack to remedy leaving you with a substantial mess of a WordPress installation. There are some other things you can do to help solve issues with slow queries. ...


4

You have probably added the definitions too late. If in fact you added that "to the end" of wp-config.php then you added it after these lines: /** Sets up WordPress vars and included files. */ require_once(ABSPATH . 'wp-settings.php'); If so, then those constants are already defined (wp_initial_constants) and you cannot redefine a constant after it is ...


4

I use Dropbox as well, but not directly linked as the Dropbox folder path could differ from install to install. My Dropbox just is the root of my bare git repository. Simplified... When I start coding, I just add a new folder to my Dropbox and --bare init it. // Inside your Dropbox/webdev/themes folder for e.g. git --bare init Then inside your new Theme ...


4

You can do this by adding some code to wp-config.php $request_uri = $_SERVER['REQUEST_URI']; $debug_dirs = array ('/debug-dir1/','/debug-dir2/'); // list of directories to turn on debugging foreach ($debug_dirs as $debug_dir) { if (!strncmp($request_uri,$debug_dir,strlen($debug_dir))) { define('WP_DEBUG', true); } } define('WP_DEBUG', ...


3

It's best to just log errors to the server and then use bash or a server script that supports email and error analysis (instead of PHP). There are lots of log file tools out there, simple ones like Logwatch, Swatch, Octopussy, or more complex ones like Nagios. For errors which are triggered using WP_Error you can write an email alert or log function right ...


3

It turns out that all WP_DEBUG_LOG does is: ini_set( 'log_errors', 1 ); ini_set( 'error_log', WP_CONTENT_DIR . '/debug.log' ); So, if you want to change the log location for WP_DEBUG_LOG in a plugin or theme, webaware's answer is best. If you just want to have it changed within wp-config.php you can replace define( 'WP_DEBUG_LOG', true ); with the above 2 ...


3

When WordPress loads multisite, it includes the relevant MS specific files in wp-settings.php The relevant lines: <?php // Initialize multisite if enabled. if ( is_multisite() ) { require( ABSPATH . WPINC . '/ms-blogs.php' ); require( ABSPATH . WPINC . '/ms-settings.php' ); } elseif ( ! defined( 'MULTISITE' ) ) { define( 'MULTISITE', false ...


3

Does Wordpress core has this function defined somewhere? While I haven't used it, you are probably looking for wp_salt or wp_generate_password. wp_salt is located in wp-includes/pluggable.php. can these salts be generated randomly Yes, of course. are there any specific rules for creating them There is no specific rule. The generic rule is to ...


3

You don’t need a separate rule in your .htaccess. Add … define( 'WP_CONTENT_DIR', 'YOUR_LOCAL_PATH' ); define( 'WP_CONTENT_URL', 'YOUR_PUBLIC_PATH' ); … to your wp-config.php. Do not write into wp-settings.php. This file will be overwritten during the next update – never touch a core file.



Only top voted, non community-wiki answers of a minimum length are eligible