Since order allow,deny is deprecated in 2.4 I wanted to rewrite the rules in my .htaccess file to use the new rules. Previously I was using:

<files wp-config.php>
    order allow,deny
    deny from all

Which I've rewritten to:

<FilesMatch "wp-config.php">
    Require all denied

How do I confirm that my method is actually working? I'm not certain how hackers might gain access to this file so I don't know how to test it.

  • 1
    What is this supposed to help against? If you can answer that, you can test it
    – kero
    Commented Nov 2, 2018 at 14:54
  • To be honest, I'm not certain. My boss told me that it needed to be protected. The method using Allow and Order was written by someone else before I started working here. All I know is that hackers are able to (somehow) gain access to an unprotected file. I've tried researching how they do it, but I'm coming up with nothing. Commented Nov 2, 2018 at 14:59
  • 1
    This is not really WordPress specific, you might have better luck at ServerFault or Security. As far as I understand this is done to, in case of misconfiguration of the server, keep the wp-config.php private. My personal opinion: if the server is misconfigured, why should .htaccess still work. So we don't do this, but have the file have CHMOD 0600 (-rw-------).
    – kero
    Commented Nov 2, 2018 at 15:06

2 Answers 2


The old method works for me, and any requests result in a 403 status response instead of execution of the php script. I've not checked your 2nd method, but if it works it will similarly respond with 403 denied/forbidden.

To test you simply have to insert the URL of your "wp-config.php" in the address bar of your browser e.g. http://example.com/wp-config.php . Depending on browser and/or sites custom 403 settings your browser will display "forbidden", "access denied" etc.

Note you can also move wp-config.php one directory up from where Wordpress installed it - and if this is then above Webroot/public_html it will no longer be "directly" accessible by hackers. More on this here Is moving wp-config outside the web root really beneficial?

  • The old method does not work in 2.4 and I prefer not to use deprecated methods. Also, it seems that wp-config.php file is not accessible through your browser. If you attempt that it the browser returns a blank page. Commented Nov 2, 2018 at 17:56
  • If you request wp-config.php and get a blank page (200 OK response) then that suggests the file is accessible, since that is the expected output of wp-config.php. The problem is that if there is a server misconfiguration that resulted in PHP files not to be processed by the PHP parser then the raw PHP code, including your DB connection credentials, will be sent as plain text to the client. That is the reason for blocking direct access. However, as scytale mentions, it would be preferable to move the wp-config.php file out of the public HTML webspace (if that is an option for you).
    – MrWhite
    Commented Nov 2, 2018 at 19:38

I discovered that by looking at my server's error logs I could see where the server denied permission to me when I attempted to visit http://example.com/wp-config.php

It looked like this:

[Fri Nov 02 17:52:22.222222 2018] [authz_core:error] [pid 222] [client] AH01630: client denied by server configuration: /nas/wp/www/sites/example/wp-config.php

  • Curious you are seeing an "error" state in your server's "error log"? This shouldn't trigger a "server error". If you are blocked from accessing this file then you should see a 4xx response in the servers "access log" - this is an HTTP response, not a server error. (?)
    – MrWhite
    Commented Nov 2, 2018 at 19:43
  • It was in the Apache logs. Commented Dec 13, 2018 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.