Considering the information that is in the wp-config file, how secure is this file? I have password salts in place, but can someone view this file? Or to what level of difficulty can some view the contents?


This is really more of a server configuration question. By necessity, wp-config.php must be readable by WordPress itself, but file access/security beyond that is really a matter of how your server is configured.

| improve this answer | |
  • Ok, but can some view into my wp-config and see the password for my db? – FluxEngine May 16 '13 at 20:17
  • There is no definitive answer to that question. – Chip Bennett May 16 '13 at 21:47

This could be hacked if for example a bad plugin is installed and creates flaws. This could be hacked because of the CRSF flaw that is to say a hacker utilizes an approved user account to make bad things.

You could start with this in .htaccess:

<files wp-config.php>
order allow,deny
deny from all

But there is not an absolute protection.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.