I read the following tutorial, which mentions moving your config file out of an HTTP-accessible folder.


I did this, and it works fine. And when I visit http://mysite.com/wp-config.php, I see a blank page, as expected. However, when I visit http://mysite.com/wp-settings.php, I receive the following error:

Warning: require(ABSPATHwp-includes/load.php) [function.require]: failed to open stream: No such file or directory in /home/{my user name}/mysite.com/wp-settings.php on line 19

Fatal error: require() [function.require]: Failed opening required 'ABSPATHwp-includes/load.php' (include_path='.:/usr/local/lib/php:/usr/local/php5/lib/pear') in /home/{my user name}/mysite.com/wp-settings.php on line 19

I'm new to WordPress and PHP, but not new to programming. Obviously, having my shell user's name output to the web if someone were to hit my wp-settings file is a no-no.

So, can you have your config file out of the web directory, as I have here, without files like wp-settings resulting in sensitive information leaked to the screen? Am I going about this all wrong?

1 Answer 1


Hm, core WP files are usually die properly if opened directly. It probably slipped developers to include check in this one or something.

The simple ways to fix this (and not really WP-specific) would be to:

  • configure PHP on server to not display errors by default;
  • restrict access to file with .htaccess or other means.
  • Thanks for the suggestions. If you don't mind my asking, do you use the paradigm in that article (moving your config out of a web directory)? If not, why not?
    – Andy
    Commented Mar 14, 2011 at 20:07
  • @Andy if something fails or mis-configured server-side and wp-config.php is served as plain text file - it contains sensitive information like database credentials. Rest of the files are generic to WordPress and do not contain anything that might compromise your installation if their content is revealed.
    – Rarst
    Commented Mar 14, 2011 at 20:43
  • @Rarst: Thank you. Should I be checking any other pages to be sure they die properly if accessed directly?
    – Andy
    Commented Mar 14, 2011 at 20:46
  • 1
    @Andy best approach is to configure your server to never output errors to visitors. That is just good practice and is really actual issue here.
    – Rarst
    Commented Mar 14, 2011 at 20:57
  • I tried adding "php_flag display_errors off" to my htaccess file, but the settings page still outputs the error. I got it to redirect to 404 by adding a "deny from all" to htaccess, but I'm still worried that other pages might display errors.
    – Andy
    Commented Mar 14, 2011 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.