Hot answers tagged wp-config
22
Here is how I do it and I haven't come across anything better than this. I keep a different version of wp-config.php file under version control and then keep a file one directory above which holds all the database credentials and salts/keys. Also this way, I am able to distinguish between the type of setup I am running and do things differently on basis of ...
16
I think Max's is a knowledgeable answer, and that's one side of the story. The WordPress Codex has more advise:
Also, make sure that only you (and the web server) can read this file
(it generally means a 400 or 440 permission).
If you use a server with .htaccess, you can put this in that file (at
the very top) to deny access to anyone surfing ...
15
Definitely YES.
When you move wp-config.php outside public directory you protect it from reading using browser when php handler gets maliciously (or accidentally!) changed.
Reading your DB login/password is possible when server is hardly infected through a fault of lame administrator. Charge the administrator a fine and get well-tended and reliable server. ...
15
Short answer: yes
The answer to this question is an unequivocal yes, and to say otherwise is completely irresponsible.
Long answer: a real-world example
Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured.
The bug:
Take a look at this ...
12
The "Hardening WordPress" page of the Codex contains a section on "Securing wp-config.php". It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that.
Of course there is some danger to having a file with the password like this if someone gets access to ...
12
The biggest thing is the wp-config.php contains some sensitive information: your database username/password, etc.
So the idea: move it outside the document root, and you don't have to worry about anything. An attacker will never be able to access that file from an external source.
Here's the rub, however: wp-config.php never actually prints anything to the ...
8
Symbolic links are … risky in WordPress. It is easier to use a separate domain for plugins per wp-config.php:
define( 'WP_PLUGIN_DIR', '/local/path/to/plugin/directory' );
define( 'WP_PLUGIN_URL', 'http://plugins.dev');
See Strategy On Building Plugin Using Eclipse as an example for IDE configuration with such a setup.
7
There is, as far as I know, no way to hook into wp-config.php from a Theme. For one, wp-config.php shouldn't be writeable; for another, wp-config.php is executed well-before a Theme's functions.php file is parsed. For a great overview of how WordPress boots, have a look at this two-part post by Theme.FM (part 1, part 2) or this Explanation with a flowchart ...
7
http://wordpress.org/extend/plugins/wordpress-beta-tester/
Sets you up for the nightlies, if that is what you are looking for. I've got it running on my dev install @ cdn.rvoodoo.com. Works great there
6
How can I do this without exposing my passwords to git, in case this repository ever becomes public?
If your wp-config.php file is in version control, then any passwords it contains will also be in version control. The only way to avoid that is to not put the file in version control.
Is this too much trouble and should I just leave wp-config.php ...
6
I don't think there is a universal URL hook. There are a lot of hooks and I may have missed it, but I don't think there is one. You can look through the hooks at adambrown.info. There are a lot of URL hooks, but not a universal one.
If I may suggest another solution: Log the errors to a files.
/**
* This will log all errors notices and warnings to a file ...
5
Apparantly this happens with the newer version of domain mapping because sunrise.php itself needs to be updated. To solve it I:
Copy the new sunrise.php file from wp-content/plugins/wordpress-mu-domain-mapping/sunrise.php to wp-content/sunrise.php and you'll be fine.
And it works now.
5
You don't really need to remove these files. It's much easier to just block access to them. If you are using pretty URL's you already have an .htaccess file. Using .htaccess to block the files is secure and you only have to add a directive once.
Blocking files is done by adding a directive to .htaccess like this:
<files filename.file-extension>
...
5
You can do the following:
Set EMPTY_TRASH_DAYS to a very high number. E.g.: define( 'EMPTY_TRASH_DAYS', 1000000 );
Or remove the wp_schedule_delete action:
function my_remove_schedule_delete() {
remove_action( 'wp_scheduled_delete', 'wp_scheduled_delete' );
}
add_action( 'init', 'my_remove_schedule_delete' );
5
Someone asked us to shine in, and I will reply here.
Yes, there are security benefits from isolating your wp-config.php from the root directory of your site.
1- If your PHP handler gets broken or modified in some way, your DB information will not be exposed. And yes, I saw this happen a few times on shared hosts during server updates. Yes, the site will be ...
5
I just want to clarify, for the sake of argument, that moving your wp_config.php file does not necessarily mean you have to move it only to the parent directory. Let's say you have a structure like /root/html, where html contains the WP installation and all of your HTML content. Instead of moving wp_config.php to /root, you could move it to something like ...
4
Hm, core WP files are usually die properly if opened directly. It probably slipped developers to include check in this one or something.
The simple ways to fix this (and not really WP-specific) would be to:
configure PHP on server to not display errors by default;
restrict access to file with .htaccess or other means.
4
define('FS_METHOD', 'ftpext');
define('FTP_BASE', '/path/to/wordpress/');
define('FTP_CONTENT_DIR', '/path/to/wordpress/wp-content/');
define('FTP_PLUGIN_DIR ', '/path/to/wordpress/wp-content/plugins/');
define('FTP_PUBKEY', '/home/username/.ssh/id_rsa.pub');
define('FTP_PRIKEY', '/home/username/.ssh/id_rsa');
define('FTP_USER', 'username');
...
4
Change the name of news.php to index.php.
I don't know of any legitimate use case that exists for changing index.php.
If something else is using index.php then move WP in its own /news directory.
You could change the .htaccess but you might run into trouble down the road.
4
To make a case for keeping your config file one level up from the web root (as mrwweb suggested): a few months ago, an automatic update on a production server of ours killed php but left apache running. So everyone coming to the homepage was being offered index.php as a download. In theory, anybody who knew it was a WordPress site could have requested ...
4
Pam,
It sounds like you are facing some major challenges, but I would highly recommend not messing with the table prefix. Doing so will lead to a series of problems, which will require hack after hack to remedy leaving you with a substantial mess of a WordPress installation.
There are some other things you can do to help solve issues with slow queries. ...
3
You don’t need a separate rule in your .htaccess. Add …
define( 'WP_CONTENT_DIR', 'YOUR_LOCAL_PATH' );
define( 'WP_CONTENT_URL', 'YOUR_PUBLIC_PATH' );
… to your wp-config.php. Do not write into wp-settings.php. This file will be overwritten during the next update – never touch a core file.
3
There is no config setting or definition you can set that will automatically update WordPress.
Your options are to use the Beta Tester plugin, manually update, or do an svn up.
You could set up a cron job on your server to run the svn up command every 12 or 24 hours but if there is a database upgrade you will still have to manually push the "upgrade ...
3
You can just redefine it in your functions.php file (call define with the key/value you want). Since it loads later, it's going to be replaced with your value. I just tried this with a plugin, it generated some unexpected output errors, but it worked.
That said, if this is a theme for public consumption, it is definitely not your job to change site wide ...
3
Mark's example assumes you are working with a private repo:
if ( file_exists( dirname( __FILE__ ) . '/local-config.php' ) ) {
include( dirname( __FILE__ ) . '/local-config.php' );
define( 'WP_LOCAL_DEV', true );
} else {
define( 'DB_NAME', 'production_db' );
define( 'DB_USER', 'production_user' );
define( 'DB_PASSWORD', ...
3
Does Wordpress core has this function defined somewhere?
While I haven't used it, you are probably looking for wp_salt or wp_generate_password. wp_salt is located in wp-includes/pluggable.php.
can these salts be generated randomly
Yes, of course.
are there any specific rules for creating them
There is no specific rule. The generic rule is to ...
3
Even though my first approach was for the garbage bin and s_ha_dums answer is a clean, and probably the best, way of going about it, let me offer one more working scenario, for the sake of completeness:
functions.php:
function zs_admin_debug( $user_login, $user ) {
if ( in_array( 'administrator', $user->roles ) ) {
setcookie( 'wp_debug', ...
3
When WordPress loads multisite, it includes the relevant MS specific files in wp-settings.php
The relevant lines:
<?php
// Initialize multisite if enabled.
if ( is_multisite() ) {
require( ABSPATH . WPINC . '/ms-blogs.php' );
require( ABSPATH . WPINC . '/ms-settings.php' );
} elseif ( ! defined( 'MULTISITE' ) ) {
define( 'MULTISITE', false ...
2
WPLANG effects the whole site not just the admin section, you can use it in conjunction with WPML. It basically sets what language you have translations for but you must include a languages folder inside wp-include with the appropriate .mo and .po files.
You can also set WPML to use the default languages directory ( which is set up by defining the ...
2
You don't need a rewrite rule in .htaccess to add www back in. Remove the rewrite rule, remove all the defines in wp-config and try to login. If that doesn't work, delete permalinks in .htaccess to force them back to default.
After you're in, add the www in Dashboard>>Settings and save. Then reset permalinks.
Only top voted, non community-wiki answers of a minimum length are eligible
