wordpress configuration file is located in the root.In the event that PHP stops functioning on webserver for any reason.we run the risk of this file being displayed in plaintext,which will give our password and database information to visitor.
you can safely move wp-config directory up out of root directory.this will stop if from accidentally served. WordPress has built-in functionality that automatic check parent directory if it cannot find a configuration file.
In this situations on certain hosts, is not option. An alternative on Apache web servers is to set your .htaccess to not serve up the wp-config file.
Add the following line to ur .htaccess file in the root directory.
<FilesMatch ^wp-config.php$>deny from all</FilesMatch>
Related Posts:
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- Hack-Proof OR Security in WordPress — is it real?
- Some one is trying to hack my website, Need guidance [closed]
- Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?
- Website show Google Ads when we have no Google Ads linked to our website
- WordPress disable direct access of files in WordPress installation path
- Being hacked. Is there a list of WordPress security holes I can check against?
- My WP site and password was hacked, what to do? [closed]
- What security concerns should I have when setting FS_METHOD to “direct” in wp-config?
- What Are Security Best Practices for WordPress Plugins and Themes? [closed]
- Are WordPress Plugins essential?
- I found this in a plugin. What does it do? is it dangerous?
- What are the common security flaws I need to look for? [closed]
- Disabled plugins are they security holes – rumor or reality?
- What could a hacker do with my wp-config.php
- How Can I Securely Implement a Password-less Login Feature?
- Security and .htaccess
- Why “Contact Form 7” doesn’t update PHPmailer library?
- Are there procedures to prevent malicious plugin updates?
- Secure WordPress paid plugin
- How to make media upload private? [duplicate]
- Does WordPress contain “default” anti-SQL injection code that responds with a 404 error?
- What does a security risk in a plugin look like?
- How to generate/update a XML sitemap without plugins?
- WordPress Capabilities: edit_user vs edit_users
- Should we use plugins that aren’t available from the official WordPress site?
- How to check plugins for malicious code?
- How to properly secure my WordPress installation?
- Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?
- Where should my plugin POST to?
- Security error WP 4.0 + WP phpBB Bridge [closed]
- Should I install plugins to my WordPress installation from web sites having in URL “nulled” or, “null”?
- Disabled plugins are security holes – rumor or reality?
- Why am I sometimes getting a 404 error when I try to update a page with Elementor?
- Should I use RIPS tool to test my themes and plugins?
- Prevent Brute Force Attack
- Why users disable the WordPress update?
- Intercept comment form submit/list by hook/filter
- How many security plugins are too many? [closed]
- Will WordPress username displayed somewhere in the site?
- Upgrading WordPress 4.0 asks for FTP password
- How to prevent bot or someone to modify any file automatically?
- Is revealing just the AUTH_KEY a security issue?
- How Restrict access to admin dashboard by specific static ip?
- When is it useful to use wp_verify_nonce
- Protecting against malicious code in WordPress plugin updates
- Questions about brute force attacks on the admin username, coming from amazon IP addresses
- Why Better WP security plugin returns 418 I’m a Teapot “error”?
- How to expire all wordpress user passwords instantly?
- How to limit WordPress pages during updates?
- rms_unique_wp_mu_pl_fl_nm.php
- Weird problems after recovery from security breach
- How can we deal with unmaintained plugins with vulnerabilities?
- Security checking in meta_box save is reluctant?
- Escape when echoed
- Should you escape hardcoded URLs?
- Preventing BFA in WordPress without using a plugin
- Is it dangerous to install unupdated plugins?
- How can I make uploaded images in the editor load with HTTPS?
- How to stop xmlrpc attacks without disabling component to allow JetPack to work in WordPress?
- WordPress filter that hook after each action/filter hook
- How to delete Passwrd Protected posts cookies when a user logged out from the site
- The safest way to automate WordPress backups
- wp_create_nonce function doesn’t work inside a plugin?
- Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)
- Upgraded to latest version – 3.0.3 and Now I get a “sufficient permissions to access this page” error
- Headers Content-Security-Policy CSP Major Issue
- How to block plugin activations with no known user or coming from unknown IP address range?
- Nonce failing on form submission
- Check for security updates
- Standard Fail2Ban vs. WP Fail2ban vs. WP Fail2Ban Redux
- How can I safely hide the fact that my website runs on WordPress? [closed]
- Why can’t I access my Intranet LDAPS with NADI?
- Malicious File Upload [closed]
- Stop Plugin Enumeration [closed]
- Malware installation during plugin update?
- My WordPress website was hacked [closed]
- I should enable automatic updates?
- Can some vulnerabilities in plugins be exploited even when the plugin is inactive?
- Is wp-app.php or wp-apps.php needed for WordPress?
- Security and Must Use Plugins
- Is Timthumb still broken? What security measures should be taken?
- Prevent direct access to WordPress plugin assets?
- Is it safe to use admin-ajax.php in the frontend?
- How to protect WordPress from security scanner [closed]
- Specific way to allow WordPress users to view their current password? And edit it?
- Too many login attempts
- How to prevent plugins from sniffing/stealing other plugins’ options?
- how to activate a plugin inside a theme
- Vulnerability Concern From the Plugin or From Not Updating the Plugin?
- malware undetectable by multiple scans
- Custom API plugin to execute 3rd party API to retrieve data
- How to deal with Slow HTTP POST (slowloris) vulnerability
- Running multiple security plugins
- how do I secure my WP website from hackers? [closed]
- Chrome Dev Tools console says every page in my blog has link to http://maps.google.com [closed]
- Webservice credential storage [duplicate]
- Regarding plugin security
- How do I determine if the user who registered is not spam?
- Want to modify a Plugin – Tweetily – Can I make it tweet a Custom Field instead of Post Title?