I am trying to secure my wordpress blog. I read some posts on the web that I should change my table_prefix and hide my wp-config.php. However, I do not get it? What could an attacker do with my wp-config.php?

I mean there are my db configurations, but the attacker needs my DB_HOST for example, which is not that easy to get, in order to connect to my db?(In my case its: define('DB_HOST', 'localhost');, which the attacker could not use to connect to my db)

Or am I missing sth?

I really appreciate your reply!

  • I guess, it will be easy for him to inject SQL. Starred. Waiting for experts to answer this.
    – Robert hue
    Commented Sep 3, 2014 at 11:50
  • You could also post it on Programming Puzzles & Code Golf beta and see what people come up with. :) Commented Sep 4, 2014 at 0:00
  • 1
    @JoshuaTaylor Please no. Aside from the obvious ethical issues, that's not what our site is about: We only like questions that are able to have an objective winning criterion to decide which solution wins, not just "Hey, let's all write code and have fun! Yaaaay!"
    – Doorknob
    Commented Sep 4, 2014 at 2:26
  • @Doorknob Well, obviously it'd be a popularity contest. But in earnest, I'd hoped that the ":)" would convey that I wasn't serious. If anyone's tried posting their wp-config files as a result, please accept my apologies. Commented Sep 4, 2014 at 2:33

3 Answers 3


localhost refers to the machine it's running on. For example on my own site tomjn.com localhost is as it always is. This doesn't mean the hacker doesn't know where to connect, it means the hacker replaces localhost with tomjn.com.

Of course if I have a proxy sitting in front this won't work, but keep in mind that if the attacker has access to my wp-config.php, that same access would let them do other things on that machine.

So now the attacker has your database details, and they can read wp-config.php. They now have access to everything in your database, and can change anything in your database.

Depending on the security of your install, they can create a user for themselves, log in, upload a plugin via zip with a PHP Shell script, and start issuing commands or use the site as part of a bot net.

They also have your salts and secret keys ( if you don't have any of these, bad bad bad ), so brute forcing your users passwords becomes significantly easier. They also have access to their emails.

Suffice to say getting wp-config.php is one of the worst things that could happen. Many more things can be done with it but it would take months to type out every possible attack resulting from this.

In the event your wp-config.php is acquired, it's likely that an automated attack script did it, not an actual person. Change all your details, reset all passwords, and close the hole.

  • 2
    This doesn't mean the hacker doesn't know where to connect, it means the hacker replaces localhost with tomjn.com. > That's assuming you have the port to the database accessible to the outside world. Wouln't you be safe if you closed off the port in the firewall rules, only allowing computers on the local network (including the computer running wordpress itself) to connect to the database?
    – IQAndreas
    Commented Sep 3, 2014 at 16:51
  • 1
    It would still be the correct location, but yes the ports are relevant, I was mainly aiming at the original note in the question
    – Tom J Nowell
    Commented Sep 3, 2014 at 18:53

If you only accept access to the database from localhost (this isn't achieved by defining DB_HOST as localhost)? Not too much by itself (the worst case would be an attacker taking over the admin account), but in combination with other vulnerabilities it might be helpful for an attacker to have access to your config.

Login Credentials

People reuse their usernames and passwords. An attacker will check if your database username and password (or variations of them) work for your wordpress installation, for your hoster, for your email, etc.

At the very least an attacker gets an idea of what kind of passwords you use (totally random, only lowercase/numbers, length, etc).

Table Prefix

If there is an SQL injection possible, an attacker must know the table names. Depending on the database, this might be very easy, or it might involve guessing. If it does involve guessing, it is best to have the table prefix.

Keys and Salts

I found this article suggesting that you really don't want these leaked (basically, anyone could take over your admin account), although I don't know how up-to-date it is.

Database Charset

Some SQL injections depend on the character set, so it's good for an attacker to know this.


If you don't allow outside access to the database, if you don't reuse passwords, and if you don't have any SQL injections anywhere, the main worry would be the key and salts.

  • That article is up-to-date enough. You do not want your salts and keys leaked. Those are private information. If you even suspect they have been made available, then immediately change them to some other set of random data. There is no real downside to changing them, it will simply log you out of the website and you have to log back in again. You can obtain a new randomized set of keys and salts from here: api.wordpress.org/secret-key/1.1/salt
    – Otto
    Commented Sep 4, 2014 at 3:51

I assume you are asking about read access, as write access is basically access to inject his own code to do anything he likes with your site.

Your assumption that DB info is not sensitive is wrong. Lets assume your site is hosted at godaddy. godaddy AFAIK is using a dedicated mysql servers which probably can be accessed only from their own servers, but if I know your details how hard is it for me to create a godaddy account and write a script that accesses your DB? In case of local DBs it is harder to exploit but on shared hosting servers you might have 100 sites sharing the server with you, can you trust them to be secured enough that Mr Evil can not break into them and use them to attack your site?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.