1

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take the site down (for more than a minute).

I am also concerned that if I manually change the DB password directly in the wp-config.php file that it will be visible and un-encrypted. For example if my initial password at install was "please" it would display in the wp-config.php file as "aDQps4txy".

So what is the best way to go about updating the database password?

Thanks in advance.

2

This is technically challenging. WordPress must have access to your DB password in plain text. Having access to wp-config.php contents is already breach of security in progress.

There are alternate approaches to configuration, such as loading credentials via environmanet variables, but in practice they are used exceedingly rarely because PHP config file is reasonable solution already.

It's not clear why do you assume someone will get access to the config. As low hanging fruit you can place it outside of web accessible directory. WordPress will scan for config up one directory level above itself. For subdirectory installs you could use require to load config content from elsewhere, but even that is rarely done.

  • I am not sure what was compromised, so I want to be cautious and update the password. Once I opened the file I saw it looked like it had been encrypted with MD5 hash (based on what I have read in searches). If the only way to update it is to just update the password right there in the config file (with no encryption) then that is what I will do. But having seen that it's encrypted prompted me to ask the question. – MagRat Nov 25 '14 at 16:44
  • 1
    @ChasesWork I am not entirely sure about your situation. MD5 isn't reversible (by purpose at least) and isn't suitable for encryption in a first place. It's not a common practice to have database password in wp-config.php to be encrypted in any way. – Rarst Nov 25 '14 at 16:54
  • It's very possible I am just misunderstanding all of this. My confusion lies in that the DB password in the config file is not the actual DB password. – MagRat Nov 25 '14 at 16:58
  • If that was the case your site wouldn't work. :) You might be looking at the wrong configuration file or you might have more than one valid set of database credentials. – Rarst Nov 25 '14 at 17:00
  • I can assure you I am looking at the live config.php file on the server. I'm realizing it is a moot point because the server is basically toast if they get access to that right? I do appreciate your assistance. – MagRat Nov 25 '14 at 17:22
0

Your actual DB password is stored unencrypted in the wp-config.php, i.e., if your password is foobar, the corresponding line in wp-config.php is:

/** MySQL database password */
define('DB_PASSWORD', 'foobar');

As @Rarst pointed out:

Having access to wp-config.php contents is already breach of security in progress.

This is because PHP is a hypertext preprocessor. Anyone who accesses wp-config.php via their web browser will have the file routed through the server-side PHP interpreter. The interpreter passes only those data onto the client (the web browser) that it has been instructed to output. The DB password is not outputted by PHP. When I access my wp-config.php through my browser, I get an empty page with no source code at all because this file does not output anything at all.

However, it is not true that having the DB password stored unencrypted is completely risk-free. Anyone who gets the chance to bypass the PHP interpreter and hence read the file's source will gain access to your password. This is also what @Rarst meant. To be clear, this can also be a man-in-the-middle who is eavesdropping on your unencrypted FTP connection. The moment you download wp-config.php through an insecure FTP connection (in contrast to an encrypted SFTP connection) in order to edit it and re-upload it again to your server, the possibility your password being spied on does exist.

The easiest way to prevent most attacks is to keep your server up-to-date through security updates and to ensure to always use secure protocols (HTTP/FTP over TLS = HTTPS/FTPS instead of HTTP/FTP, alternatively SFTP, and SSH instead of Telnet) when dealing with sensitive data, i.e. when acting as administrator.

Read more on https://codex.wordpress.org/Hardening_WordPress.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.