To protect the security of WordPress sites, we need to focus on protecting wp-config.php files. 1. Restrict external access to wp-config.php through server configuration (such as Apache's .htaccess or Nginx configuration); 2. Set reasonable file and directory permissions, and it is recommended that wp-config.php permission be set to 600; 3. Move wp-config.php to the non-public directory above the website root directory to improve security; 4. Ignore this file in the version control system to avoid leakage of sensitive information; 5. Regularly update the security key in wp-config.php to prevent the risk of session hijacking. These measures can effectively improve WordPress security and operate without complexity.

Protect the security of your WordPress site, starting with the most basic files. wp-config.php is one of the most critical configuration files for WordPress, which contains sensitive content such as database connection information, security keys, etc. If this file is acquired by the attacker, the entire website may be controlled. Therefore, protecting the wp-config.php file is an important step in WordPress security protection.

Restrict access to wp-config.php

The most common practice is to prohibit external access to this file through a server configuration (such as .htaccess or Nginx configuration).
For users using Apache, adding the following code to the .htaccess file can prevent anyone from accessing directly through the browser:

 <Files wp-config.php>
    Order Allow,Deny
    Deny from all
</Files>

If you are using Nginx, you can add it to the site configuration:

 location ~ /wp-config.php {
    deny all;
}

In this way, even if others know the file path, they cannot directly access it.

Also, make sure that your WordPress installation directory permissions are set reasonably:

• Set folder permissions to 755
• Set file permissions to 644
• In particular, wp-config.php itself is recommended to set to 600, and only the owner can read and write.

Move wp-config.php to a non-public directory

WordPress allows you to place the wp-config.php file outside the root directory of the website. This way, even if the server configuration error occurs, the file will not be exposed.

For example, you can place wp-config.php in a directory that is higher than the root directory of the website, for example:

• Original path: /var/www/html/wp-config.php
• New path: /var/www/wp-config.php

WordPress will look for this file in the current directory by default. If it is not found, it will look for the previous directory until it is found. So as long as you put the file in the right location, WordPress will still run normally, and externally cannot be accessed through the URL.

Although this method is a little troublesome, it greatly improves security.

Don't expose wp-config.php to version control system

Many developers are accustomed to submitting website code to version control systems such as Git, but once the database username, password, security key and other information in wp-config.php is leaked, the consequences will be serious.

The solution is simple:

• Add wp-config.php in .gitignore file
• If you use template configuration files in team collaboration, you can use wp-config-sample.php as the template and manually fill in the actual configuration during deployment

In addition, some hosting platforms (such as WP Engine and Kinsta) have hidden wp-config.php by default, and they configure databases and keys through environment variables, which is safer and easier to manage.

Regularly check security keys in wp-config.php

WordPress uses a set of "security keys" to encrypt user login information. If you haven't touched wp-config.php for a long time, the key inside may still be default or has been leaked.

You can go to WordPress Salt Generator to get the new random key and replace the old one. This will not affect the login status of existing users (unless you clear cookies), but will prevent potential session hijacking risks.

The replacement method is very simple:

• Open the link above to generate a new salt value
• Copy and replace the corresponding constant definition in wp-config.php
• Save and upload files

Although this operation is simple, it is very effective.

Basically that's it. As long as you do a good job in access control, storage location, version management and key update, the security of wp-config.php can be greatly improved. Not complicated but easy to ignore.

The above is the detailed content of How to secure the wp-configphp file. For more information, please follow other related articles on the PHP Chinese website!