0

I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and certificate.pem)?

My server has the following structure:

-/
   -/mywebsite.com
       -/data
       -/logs
       -/wwwroot
            -/wp-admin
            -/wp-content
            -/wp-includes

I understand that ASP.NET has a file called web.config file that is secure and stored at wwwroot. What's something equivalent using PHP? It is also my understanding that Wordpress stored database password in wp-config.php located at wwwroot so I assume wwwroot is a secure directory?

I'm using a shared host btw.

Thanks.

Improve this question
6
  • 1
    It all depends on what you mean by 'secure' as there's a pretty wide scope of possible meanings. Directory security is going to be on the host/IIS config, not Wordpress. – Will Dec 23 '15 at 6:51
  • Read about WordPress security here - wordfence.com/learn – jgraup Dec 23 '15 at 6:54
  • So my mission is pretty straight forward as i want to define('MY_PASSWORD'. 'Abcd') inside wp-config.php. Is is safe? Also storing my certificate.pem under \wwwroot is safe too? Must there be other settings I need to config in my host to keep those data safe? – Loc Pham Dec 23 '15 at 6:59
  • does htaccess dont work in ur server? codex.wordpress.org/htaccess – DrMosko Dec 24 '15 at 1:11
  • 1
    No it's a windows server so no htaccess – Loc Pham Dec 24 '15 at 1:13
0

You are comparing two different things. Your ASP security is really IIS security. To get similar things in wordpress you will need to configure your web server in similar ways.

Improve this answer
2
  • Do you have more detail on how i can configure it? Thx – Loc Pham Dec 23 '15 at 6:51
  • That will depend on your web server, if you use IIS, then in principal the same procedures that apply to ASP should apply here (I have almost zero experiance with IIS therefor this blanket statement is the best I can give ;) ) – Mark Kaplun Dec 23 '15 at 6:54
0

Instead of a .htaccess file you will need to create a web.config file

http://www.iis.net/learn/application-frameworks/install-and-configure-php-applications-on-iis/translate-htaccess-content-to-iis-webconfig

Improve this answer
0

The most secure directories on your web server are below the public html directory. If you have to store certs then don't put them in a public area. As long as you set permissions correctly WordPress will be able to access them via php. Consider the level of -/mywebsite.com/certs.

Wordfence has added an area of their site to talk about WordPress security so I would recommend checking it out - https://www.wordfence.com/learn/

As for passwords, there are some ideas in this Q/A but basically loading them from a non-public area is the best.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.