WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.
Sign up to join this community
Since order allow,deny is deprecated in 2.4 I wanted to rewrite the rules in my .htaccess file to use the new rules. Previously I was using:
<files wp-config.php>
order allow,deny
deny from all
</files>
Which I've rewritten to:
<FilesMatch "wp-config.php">
Require all denied
</FilesMatch>
How do I confirm that my method is actually working? I'm not certain how hackers might gain access to this file so I don't know how to test it.
The old method works for me, and any requests result in a 403 status response instead of execution of the php script. I've not checked your 2nd method, but if it works it will similarly respond with 403 denied/forbidden.
To test you simply have to insert the URL of your "wp-config.php" in the address bar of your browser e.g. http://example.com/wp-config.php . Depending on browser and/or sites custom 403 settings your browser will display "forbidden", "access denied" etc.
Note you can also move wp-config.php one directory up from where Wordpress installed it - and if this is then above Webroot/public_html it will no longer be "directly" accessible by hackers. More on this here Is moving wp-config outside the web root really beneficial?
wp-config.php and get a blank page (200 OK response) then that suggests the file is accessible, since that is the expected output of wp-config.php. The problem is that if there is a server misconfiguration that resulted in PHP files not to be processed by the PHP parser then the raw PHP code, including your DB connection credentials, will be sent as plain text to the client. That is the reason for blocking direct access. However, as scytale mentions, it would be preferable to move the wp-config.php file out of the public HTML webspace (if that is an option for you).
I discovered that by looking at my server's error logs I could see where the server denied permission to me when I attempted to visit http://example.com/wp-config.php
It looked like this:
[Fri Nov 02 17:52:22.222222 2018] [authz_core:error] [pid 222] [client 22.222.222.222:22222] AH01630: client denied by server configuration: /nas/wp/www/sites/example/wp-config.php
Allow and Orderwas written by someone else before I started working here. All I know is that hackers are able to (somehow) gain access to an unprotected file. I've tried researching how they do it, but I'm coming up with nothing.