I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php? Very similar to this. Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.

2 Answers 2


I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.

If your setup looks like: (And your public website lives inside of public_html)

  \__ wp-config.php

I would store a file in: (Which is not public facing at all)


And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.

The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials: https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/

  • 2
    Chapeau. We do this also already for years (storing the wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.
    – Charles
    Jun 21, 2019 at 18:38
  • This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases. Jun 21, 2019 at 18:48
  • 1
    What if a malicious plugin accesses wp-config.php?
    – Riccardo
    Jun 21, 2019 at 18:55
  • I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well. Jun 21, 2019 at 20:25
  • So to first step it might be storing the value in a non significative variable name, but any malicious plugin could scan all code in within the document root and beyond/below looking for "phpmailer_init" hook, and grab the variable. BTW the site along with wp-config.php is hardened through Sucuri firewall and plugin system
    – Riccardo
    Jun 22, 2019 at 15:32

If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.

Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.

Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.