I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and certificate.pem)?

My server has the following structure:


I understand that ASP.NET has a file called web.config file that is secure and stored at wwwroot. What's something equivalent using PHP? It is also my understanding that Wordpress stored database password in wp-config.php located at wwwroot so I assume wwwroot is a secure directory?

I'm using a shared host btw.


  • 1
    It all depends on what you mean by 'secure' as there's a pretty wide scope of possible meanings. Directory security is going to be on the host/IIS config, not Wordpress.
    – Will
    Commented Dec 23, 2015 at 6:51
  • Read about WordPress security here - wordfence.com/learn
    – jgraup
    Commented Dec 23, 2015 at 6:54
  • So my mission is pretty straight forward as i want to define('MY_PASSWORD'. 'Abcd') inside wp-config.php. Is is safe? Also storing my certificate.pem under \wwwroot is safe too? Must there be other settings I need to config in my host to keep those data safe?
    – Loc Pham
    Commented Dec 23, 2015 at 6:59
  • does htaccess dont work in ur server? codex.wordpress.org/htaccess
    – DrMosko
    Commented Dec 24, 2015 at 1:11
  • 1
    No it's a windows server so no htaccess
    – Loc Pham
    Commented Dec 24, 2015 at 1:13

3 Answers 3


You are comparing two different things. Your ASP security is really IIS security. To get similar things in wordpress you will need to configure your web server in similar ways.

  • Do you have more detail on how i can configure it? Thx
    – Loc Pham
    Commented Dec 23, 2015 at 6:51
  • That will depend on your web server, if you use IIS, then in principal the same procedures that apply to ASP should apply here (I have almost zero experiance with IIS therefor this blanket statement is the best I can give ;) ) Commented Dec 23, 2015 at 6:54

Instead of a .htaccess file you will need to create a web.config file



The most secure directories on your web server are below the public html directory. If you have to store certs then don't put them in a public area. As long as you set permissions correctly WordPress will be able to access them via php. Consider the level of -/mywebsite.com/certs.

Wordfence has added an area of their site to talk about WordPress security so I would recommend checking it out - https://www.wordfence.com/learn/

As for passwords, there are some ideas in this Q/A but basically loading them from a non-public area is the best.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.