Timeline for Is moving wp-config outside the web root really beneficial?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 14, 2012 at 0:12 | comment | added | Ian Dunn |
In case #2, you'd have to expand the open_basedir scope to let PHP access everything in /home/user, which seems like a huge problem to me. Anything stored there (logs, backups, .bash_history, etc) would be accessible to any infected PHP script running in /home/user/public_html. It seems like it'd be better to leave wp-config at /home/user/public_html/wp-config.php and use htaccess rules to block HTTP requests to it. You still get the benefit of blocking access in the (unlikely) event that it's displayed in plain-text, but you don't expose files above public_html.
|
|
| Jul 14, 2012 at 0:11 | comment | added | Ian Dunn | In case #1 you don't get the intended security benefit. The whole point is to move it outside the document root, not just up one level. | |
| Jul 13, 2012 at 18:10 | comment | added | its_me | @IanDunn Like I said, this is my basic understanding, and I am no security expert. :) | |
| Jul 13, 2012 at 18:10 | comment | added | its_me |
@IanDunn Depends on what the document root is— (1) If wordpress is hosted in a directory in public_html, moving wp-config.php outside the directory means that it's going to be in public_html directory. In this case, you'll have to use the htaccess rules to deny HTTP requests to wp-config.php. (2) If WordPress is installed directly under public_html directory, one level up => you'll be moving it into /home/user directory. In this case you are pretty safe as the file is outside the document root. You can still set the file's permissions to 600 (or even stricter 440 or 400).
|
|
| Jul 13, 2012 at 17:59 | comment | added | Ian Dunn | So if you use htaccess to deny HTTP requests to wp-config.php, doesn't that achieve the same result as moving it outside the document root, but without exposing logs/backups/etc? | |
| Jul 13, 2012 at 16:29 | history | edited | its_me | CC BY-SA 3.0 |
added 92 characters in body
|
| Jul 13, 2012 at 16:26 | comment | added | Max Yudin | Aahan Krish, you've hit the bull's eye. Thanks for the addition. | |
| Jul 13, 2012 at 16:15 | comment | added | its_me | Max's is the answer. +1 to him. I am simply trying to extend it. | |
| Jul 13, 2012 at 16:13 | history | answered | its_me | CC BY-SA 3.0 |