Hot answers tagged wp-config
22
Here is how I do it and I haven't come across anything better than this. I keep a different version of wp-config.php file under version control and then keep a file one directory above which holds all the database credentials and salts/keys. Also this way, I am able to distinguish between the type of setup I am running and do things differently on basis of ...
16
I think Max's is a knowledgeable answer, and that's one side of the story. The WordPress Codex has more advise:
Also, make sure that only you (and the web server) can read this file
(it generally means a 400 or 440 permission).
If you use a server with .htaccess, you can put this in that file (at
the very top) to deny access to anyone surfing ...
15
Short answer: yes
The answer to this question is an unequivocal yes, and to say otherwise is completely irresponsible.
Long answer: a real-world example
Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured.
The bug:
Take a look at this ...
15
Definitely YES.
When you move wp-config.php outside public directory you protect it from reading using browser when php handler gets maliciously (or accidentally!) changed.
Reading your DB login/password is possible when server is hardly infected through a fault of lame administrator. Charge the administrator a fine and get well-tended and reliable server. ...
12
The "Hardening WordPress" page of the Codex contains a section on "Securing wp-config.php". It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that.
Of course there is some danger to having a file with the password like this if someone gets access to ...
12
The biggest thing is the wp-config.php contains some sensitive information: your database username/password, etc.
So the idea: move it outside the document root, and you don't have to worry about anything. An attacker will never be able to access that file from an external source.
Here's the rub, however: wp-config.php never actually prints anything to the ...
6
I don't think there is a universal URL hook. There are a lot of hooks and I may have missed it, but I don't think there is one. You can look through the hooks at adambrown.info. There are a lot of URL hooks, but not a universal one.
If I may suggest another solution: Log the errors to a files.
/**
* This will log all errors notices and warnings to a file ...
6
How can I do this without exposing my passwords to git, in case this repository ever becomes public?
If your wp-config.php file is in version control, then any passwords it contains will also be in version control. The only way to avoid that is to not put the file in version control.
Is this too much trouble and should I just leave wp-config.php ...
5
I just want to clarify, for the sake of argument, that moving your wp_config.php file does not necessarily mean you have to move it only to the parent directory. Let's say you have a structure like /root/html, where html contains the WP installation and all of your HTML content. Instead of moving wp_config.php to /root, you could move it to something like ...
5
Someone asked us to shine in, and I will reply here.
Yes, there are security benefits from isolating your wp-config.php from the root directory of your site.
1- If your PHP handler gets broken or modified in some way, your DB information will not be exposed. And yes, I saw this happen a few times on shared hosts during server updates. Yes, the site will be ...
4
Pam,
It sounds like you are facing some major challenges, but I would highly recommend not messing with the table prefix. Doing so will lead to a series of problems, which will require hack after hack to remedy leaving you with a substantial mess of a WordPress installation.
There are some other things you can do to help solve issues with slow queries. ...
4
To make a case for keeping your config file one level up from the web root (as mrwweb suggested): a few months ago, an automatic update on a production server of ours killed php but left apache running. So everyone coming to the homepage was being offered index.php as a download. In theory, anybody who knew it was a WordPress site could have requested ...
4
Change the name of news.php to index.php.
I don't know of any legitimate use case that exists for changing index.php.
If something else is using index.php then move WP in its own /news directory.
You could change the .htaccess but you might run into trouble down the road.
3
When WordPress loads multisite, it includes the relevant MS specific files in wp-settings.php
The relevant lines:
<?php
// Initialize multisite if enabled.
if ( is_multisite() ) {
require( ABSPATH . WPINC . '/ms-blogs.php' );
require( ABSPATH . WPINC . '/ms-settings.php' );
} elseif ( ! defined( 'MULTISITE' ) ) {
define( 'MULTISITE', false ...
3
Does Wordpress core has this function defined somewhere?
While I haven't used it, you are probably looking for wp_salt or wp_generate_password. wp_salt is located in wp-includes/pluggable.php.
can these salts be generated randomly
Yes, of course.
are there any specific rules for creating them
There is no specific rule. The generic rule is to ...
3
Even though my first approach was for the garbage bin and s_ha_dums answer is a clean, and probably the best, way of going about it, let me offer one more working scenario, for the sake of completeness:
functions.php:
function zs_admin_debug( $user_login, $user ) {
if ( in_array( 'administrator', $user->roles ) ) {
setcookie( 'wp_debug', ...
3
Mark's example assumes you are working with a private repo:
if ( file_exists( dirname( __FILE__ ) . '/local-config.php' ) ) {
include( dirname( __FILE__ ) . '/local-config.php' );
define( 'WP_LOCAL_DEV', true );
} else {
define( 'DB_NAME', 'production_db' );
define( 'DB_USER', 'production_user' );
define( 'DB_PASSWORD', ...
2
I guess this would be of better use as a mu-plugin.
EDIT: Now available as drop & play MU-Plugin. Also disables the »Theme« editor.
<?php
! defined( 'ABSPATH' ) AND exit;
/** Plugin Name: Disable »Theme/Plugin Editor« */
if ( ! class_exists( 'disable_admin_editor' ) )
{
add_action( 'plugins_loaded', array( 'disable_admin_editor', 'init' ) );
...
2
If you want to set up your site so that you have a home page that is outside your wordpress site (which is why I assume you have renamed the wordpress index.php file) the best way to set things up is to have wordpress installed in a sub directory off the root rather than in the root.
However, given you are already 'up the creek' so to speak there is another ...
2
This question has been asked many many times before.
Here's the Codex: http://codex.wordpress.org/Changing_The_Site_URL
The easiest thing to do is add a couple of lines to your wp-config.php
define('WP_HOME','http://example.com');
define('WP_SITEURL','http://example.com');
2
You saved your wp-config.php with a Byte order mark (BOM). Save the file again without the BOM.
In Linux or Mac OS X open the file with Vim, enter …
:set nobomb
… and save it.
In Windows open it in Notepad++ and convert it to UTF-8 without BOM:
2
Looks like you have 2 WordPress installations. One for the main site, other for the Blog.
http://parlourdc.com/wp-content/plugins/akismet/readme.txt
http://parlourdc.com/blog/wp-content/plugins/akismet/readme.txt
If that's not on purpose, you have a blog folder in your site root that should be renamed/deleted as it contains a blank WordPress.
If you made ...
2
There're some things you should not play around with, until you really know core inside out and one of those things are the Path constants that can be set in your wp-config.php.
Here's how I do it. Note, that it's uncommented, so it doesn't trigger and WP uses its default.
# define( 'WP_CONTENT_DIR_NAME', 'wp-content' );
# define( 'WP_CONTENT_DIR', ...
2
It turns out that all WP_DEBUG_LOG does is:
ini_set( 'log_errors', 1 );
ini_set( 'error_log', WP_CONTENT_DIR . '/debug.log' );
So, if you want to change the log location for WP_DEBUG_LOG in a plugin or theme, webaware's answer is best. If you just want to have it changed within wp-config.php you can replace define( 'WP_DEBUG_LOG', true ); with the above 2 ...
2
Ok, based on that, I'm almost positive that you need to re-enable permalinks for your site. You are probably missing your .htaccess file or it is missing WordPress's rewrite rules.
Go to your admin and find Settings > Permalinks. Select an option, and click "Save Changes" twice (there is a quirk that this avoids).
This will have WordPress automatically ...
2
It's best to just log errors to the server and then use bash or a server script that supports email and error analysis (instead of PHP). There are lots of log file tools out there, simple ones like Logwatch, Swatch, Octopussy, or more complex ones like Nagios.
For errors which are triggered using WP_Error you can write an email alert or log function right ...
2
This is really more of a server configuration question. By necessity, wp-config.php must be readable by WordPress itself, but file access/security beyond that is really a matter of how your server is configured.
Refer to the Codex for recommended file permissions for WordPress.
Refer to the Codex for recommended ways to secure wp-config.php
Refer to this ...
2
You can easily set up another $wpdb object to access your other database.
$mydb = new wpdb(DB_USER, DB_PASSWORD, DB_NAME, DB_HOST);
var_dump($mydb);
That, of course, uses the default connection credentials but if you defined different constants and used those, is should work just fine.
If this other database is not a WordPress database, you won't have ...
1
Don't do what seems to be possible...
You can use the possibility to change the WordPress constants WP_CONTENT_DIR and WP_CONTENT_URL in your wp-config.php.
BUT it really, really, really, really is not recommended.
Why? not recommended??
It's pretty easy: Just do a cross file search (with your IDE or for e.g. Notepad++) for wp-content and you'll find ...
Only top voted, non community-wiki answers of a minimum length are eligible
