0

I'm new to Wordpress (I used to do some very Web 1.0 design work when I was a teenager in the 90s) and I just encountered something I'm truly baffled by.

I started a new account at Dreamhost with a new domain, chose the option to pre-install Wordpress, and then out of confusion unchecked Dreamhost's option that says something along the lines of "Uncheck this box if you would like to register the domain later" because I was unclear about some unrelated things.

Later on I registered the domain. Then, out of curiousity, I pointed a browser to it just to see what the default parked page looks like. I was shocked to find that there, viewable and accessible to anyone, was a page of configuration options where user passwords could be set for the first time and other options chosen. I was logged on to Dreamhost at the time so I checked both after logging out and on another machine with a different ip and it was the same. This seems insane to me; anyone could have done anything there. I deleted that installation, reinstalled, and it went to requiring you go to sitename.com/wp-login.php like normal. What happened?

Improve this question
2
  • 1
    This isn’t as big a deal as you’re making it out to be. What do you think the chances are of anyone seeing this? On a domain or website that’s never existed before and never been linked to before, and is going to exist for maybe 5 minutes, ever. If you expect Dreamhost to handle this step for you automatically as part of their, then take it up with them.
    – Jacob Peattie
    Sep 11, 2018 at 15:06
  • 1
    This sounds like something you should have spoken to Dreamhost support about. The page of configuration options you described does not sound like anything from WP Core, and your question title implied you would be seeing wp-config.php. In the absence of screenshots or excerpts I do not see how this question could be answered in a canonical manner. I can only guess that what you saw was actually the WP install page that asks what your site is named etc
    – Tom J Nowell ♦
    Sep 11, 2018 at 17:22

1 Answer 1

Reset to default
2

This is a problem with dreamhost documentation/practice (and I assume with all "one click" installation of wordpress). They should have clarified that you should complete the installation in few minutes from creating the site. The wordpress installation, with its two parts, is assumed to be done at one go.

But then, realistically there is no reason for an attacker to try to hijack such a site as it will be wiped out once discovered and there is no way for the attacker to retain control.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.