In file wp-config.php
it shows database username and password clearly
So, how to obfuscate wp-config.php or code. Serveral pages support software: ioncube, php encoder or zenguard but I don't know how to obfuscate the wp-config.php directly Example: Question: Coder don't want to someone get code and setup website again in other server.But coder has key for decrypt wp-config.php and can set up it.And what is the benefit of secret key https://api.wordpress.org/secret-key/1.1/salt/ in wordpress?
I am not sure why you would like to obfusicate your wp-config.php file. It is not accessible from the outside world and WordPress needs to be able to read the file.
If you are going to obfusicate it's quite easy to get it de-obfusicated. Since you need to alter the WordPress core (not recommended) to let it de-obfusicate the file. And if they have access to wp-config.php they als have access to the de-obfusication process.
If you are going to encrypt it, it's quite to easy to get it decrypted since you need to alter the WordPress core (not recommended) to let it decrypt the file. And if they have access to wp-config.php they also have access to the decryption process and key.
One thing you can do to 'harden' your security is to place the wp-config.php file one directory up. This way it's not in your public_html/ folder, and less experienced people wouldn't really know about it.
You can also put the database settings or just the password in a environement variable. This way you can set those settings globally and just put the variables instead of the text there. But then again, if someone can access the code base, they could easily create some extra logic to display those things to them.
