Skip to main content
Copy edited (e.g. ref. <http://en.wikipedia.org/wiki/Environment_variable> and <https://en.wiktionary.org/wiki/low-hanging_fruit#Noun>).
Source Link

This is technically challenging. WordPress must have access to your DB password in plain text. Having access to the wp-config.php contents is already a breach of security in progress.

There are alternate approaches to configuration, such as loading credentials via environmanetenvironment variables, but in practice they are used exceedingly rarely because PHP configPHP's configuration file is a reasonable solution already.

It's not clear why do you assume someone will get access to the configconfiguration file. As a low hanging-hanging fruit, you can place it outside of the web accessible directory. WordPress will scan for configthe configuration file up one directory level above itself. For subdirectory installs, you could use require to load configconfiguration content from elsewhere, but even that is rarely done.

This is technically challenging. WordPress must have access to your DB password in plain text. Having access to wp-config.php contents is already breach of security in progress.

There are alternate approaches to configuration, such as loading credentials via environmanet variables, but in practice they are used exceedingly rarely because PHP config file is reasonable solution already.

It's not clear why do you assume someone will get access to the config. As low hanging fruit you can place it outside of web accessible directory. WordPress will scan for config up one directory level above itself. For subdirectory installs you could use require to load config content from elsewhere, but even that is rarely done.

This is technically challenging. WordPress must have access to your DB password in plain text. Having access to the wp-config.php contents is already a breach of security in progress.

There are alternate approaches to configuration, such as loading credentials via environment variables, but in practice they are used exceedingly rarely because PHP's configuration file is a reasonable solution already.

It's not clear why you assume someone will get access to the configuration file. As a low-hanging fruit, you can place it outside of the web accessible directory. WordPress will scan for the configuration file up one directory level above itself. For subdirectory installs, you could use require to load configuration content from elsewhere, but even that is rarely done.

Source Link
Rarst
  • 99.9k
  • 10
  • 161
  • 298

This is technically challenging. WordPress must have access to your DB password in plain text. Having access to wp-config.php contents is already breach of security in progress.

There are alternate approaches to configuration, such as loading credentials via environmanet variables, but in practice they are used exceedingly rarely because PHP config file is reasonable solution already.

It's not clear why do you assume someone will get access to the config. As low hanging fruit you can place it outside of web accessible directory. WordPress will scan for config up one directory level above itself. For subdirectory installs you could use require to load config content from elsewhere, but even that is rarely done.