0

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server.

It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have to input the FTP details manually for each update.

1

I would consider it somewhat safe since that's where your database connection information is also stored. One could easily ruin your website by deleting your whole database if they had access to that file.

There are a couple of things you can do to increase security:

  1. Move the wp-config file one level outside the root. Wordpress knows to look for the file there.

  2. Make sure your server is hiding your root/parent index. That's an option you can usually change yourself in cpanel.

  • Thanks for your reply -- I was aware of those options. Of the couple of instances were rogue access was gained to a few of my sites it was down to other users' FTP credentials being compromised on the shared server. So I'm a little twitchy about hard coding them into a file but I suppose once a hacker had FTP access like that, it wouldn't make any difference. – Dave McCourt Mar 10 '14 at 18:26
1

It's as safe as other credentials stored in wp-config.php. As long the WordPress hardening guide is followed, as well as general security best practices, you should be fine.

Issues that could affect security:

  • Since it's a shared server, if users are not chrooted, they can read any files that have global read ownership on the server, including wp-config.php if incorrectly set.
    • You can mitigate this by removing global read from wp-config.php, which is best practice anyways.
  • File disclosure vulnerabilities could allow someone to read the configuration file through a vulnerability in the website.
    • Depending on how your web server and/or .htaccess is configured, creating backups like wp-config.bak or wp-config.php.bak will could expose that config file as it may not be protected like wp-config.php would be. Be careful where you put those. Definitely don't put them in the webroot.
    • Only use plugins you need. Uninstall ones you don't. Follow security best practices, like the hardening guide.
  • Path traversal vulnerabilities could allow the config file to be exposed and read through a vulnerability in the website, even if it's a directory up.
    • Follow the same guidelines as above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.