Can I configure wordpress to use two database usernames, one to read (which has read-only permissions in the database) and one to post (who is hidden in a protected wp-admin directory) for security purposes?

The point is that even if someone hacks wordpress, they won't have permission to do any harm.

  • 3
    Define "hacks WordPress". What situation would this protect against? – Milo Jun 14 '13 at 0:54
  • @Milo like an sql injection attack – stoppress Jun 14 '13 at 4:10
  • core inserts all use prepared statements. it's probably simpler to vet any plugins for unsafe queries. – Milo Jun 14 '13 at 4:44
  • @Milo what about select? – stoppress Jun 14 '13 at 6:20
  • any query that accepts input in core should be prepared. – Milo Jun 14 '13 at 6:30

WordPress does not allow this "configuration". And I seriously doubt you would have any luck writing a plugin that would take care of this in a complete way. The WPDB class is heavily utilized throughout the site, and sifting through read-only vs write-enabled uses would be daunting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.