10

I don't know a lot of Wordpress yet, and I'm just wondering:

Before installation you have to fill in the correct data in wp-config-sample.php but this also includes the database password. Isn't that dangerous? I mean, can some one explain how this is protected from just reading the file and thus getting the password of your DB?

14

The "Hardening WordPress" page of the Codex contains a section on "Securing wp-config.php". It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that.

Of course there is some danger to having a file with the password like this if someone gets access to your server, but, honestly, at that point they already are in your server.

Finally, you don't have much of a choice. I've never seen an alternate means of configuring WordPress. You can lock it down as much as you can, but this is how WordPress is built, and if it were a serious security threat, they wouldn't do it that way.

  • Thanks for that link! I can see a lot of security precautions there. Should one apply all of them? Or isn't anything of that really necessary? – Bram Vanroy May 29 '12 at 16:59
  • 3
    I don't know that one can ever have too much [well-implemented] security. – mrwweb May 29 '12 at 17:49
  • 1
    @mrwweb +1 for wellimplemented*. – Richard May 29 '12 at 20:16
  • Isn't it possible to override database initialization by creating a db.php file and setting $wpdb there? This would bypass the config value for the database password. – Paul Keister Apr 5 '18 at 0:30
9

To make a case for keeping your config file one level up from the web root (as mrwweb suggested): a few months ago, an automatic update on a production server of ours killed php but left apache running. So everyone coming to the homepage was being offered index.php as a download. In theory, anybody who knew it was a WordPress site could have requested wp-config.php, and gotten it (had it been in the web root). Of course, they'd only be able to use those DB credentials if we allowed remote MySQL connections--but still, not cool. I realize this is a fringe case, but it's so easy to keep your config out of sight, why not do it?

2

Unless someone has access via FTP, you don't need to worry about this. PHP is rendered on the server before it hit's the users browser.

2

Here's another tip: protect wp-config.php (and any other sensitive files) with .htaccess

Add the following to an .htaccess file in your site's directory where all other WordPress files are located:

<Files wp-config.php>
order allow,deny
deny from all
</Files>

from How to harden your WordPress installation

0

If somebody has access to read the contents of your Php files, you've already been hacked.

  • 1
    or the web server's config got seriously borked to the point of just serving .php files as text ;-) – KJH May 9 '16 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.