The “Hardening WordPress” page of the Codex contains a section on “Securing wp-config.php”. It includes changing the permissions to 440 or 400. You can also move the wp-config file one directory up from the root if your server configuration allows for that.
Of course there is some danger to having a file with the password like this if someone gets access to your server, but, honestly, at that point they already are in your server.
Finally, you don’t have much of a choice. I’ve never seen an alternate means of configuring WordPress. You can lock it down as much as you can, but this is how WordPress is built, and if it were a serious security threat, they wouldn’t do it that way.
Related Posts:
- Best practice for versioning wp-config.php?
- What’s the difference between WP_MEMORY_LIMIT and WP_MAX_MEMORY_LIMIT?
- Turn Off Automatic Trash Deletion?
- How can I change preview URL?
- Override the wp_siteurl and wp_home not work
- Changing WP_CONTENT_DIR and WP_CONTENT_URL in wp-config.php does not register?
- Missing a temporary folder despite settings in wp-config.php
- How to use live images on local install?
- Syntax of FS_CHMOD_DIR and FS_CHMOD_FILE
- WordPress PHP error handling and reporting in production environment
- WP_MEMORY_LIMIT didn’t work in wp-config
- Fatal error: Allowed memory size of 41943040 bytes exhausted (tried to allocate 20480 bytes)
- How to set up gmail SMTP in WordPress
- error:-Cannot modify header information – headers already sent by
- wp-config.php file permissions
- How to update WordPress from the latest trunk
- how to use is_admin in wp-config.php
- Locked out of WordPress Site Admin after enabling Force SSL on WordPress Https (SSL)
- Set wp-content folder to Dropbox folder
- Including a 3rd party library in WordPress which needs to be accessible by wp-config
- wp-config.php being deleted
- Get WP CLI to hide debug warnings and notices in JSON output, same setting as website
- Installation Issue WordPress locally – The file ‘wp-config.php’ already exists
- What is this file: wp-config-wpe.php?
- enable SFTP via SSH keys in wordpress
- html lang=”” instead of lang=”en-us” – why?
- Why do I get a WAMP homepage when clicking on specific website’s URL on LocalHost?
- Creating the wp-config.php file manually
- What Does this Code Snippet Do?
- WP_Debug not displaying anything
- Can I delete `wp-config-sample.php` after installing and configuring WordPress?
- How to reliably set file/folder permissions?
- Multiple wp-config.php files in one home directory
- Why edits to wp-config.php must come before “That’s all” comment
- error log cluttered with undefined DB_USER wp-admin/setup-config.php
- Is it possible to override the ABSPATH constant
- How to stop fatal error when loading theme template file directly
- Should I change wp-config for SSL?
- Out of memory errors : how best to track them down
- Redefine cookie domain for subdomains
- multiple language directories
- Error in database connection [closed]
- Update wp-config.php and lost pages
- Conflict with wp_homeurl, wp_siteurl and admin interface settings
- error messages in dashboard login
- where should I write constants in wordpress?
- Issues copying site into local machine
- Autosave interval remains default despite wp-config.php defines
- Carriage Return control character (^M) found in wp-config-sample.php
- Need help fixing my wp-config file [closed]
- Why was my new WordPress installation’s config page publicly viewable when first installed?
- WP_MEMORY_LIMIT didn’t work in wp-config, only within default-constants.php
- Cookie set without HttpOnly flag
- Changing the wp-config.php broke the site
- Publishing WordPress from stage to production server
- Define option outside wp-config.php (on WordPress.com)
- Site lost all formatting when I attempted to migrate to Bluehost [closed]
- Moving wp-config.php one level up – 500 error – Nginx [closed]
- How can I configure an SMTP Server?
- What should index.php contain on Synology NAS to get external access to WordPress to work?
- Remote server does not read `WP_HOME` from wp-config.php when local server does
- IP addresses to block to stop WP auto-update?
- Concerns over wp-config file [closed]
- Not showing old migrated content in website
- How to rename the wp-config.php file once under version control?
- Read wp-config without loading the rest of WordPress – i.e. wp-settings, etc
- Proper way to have multiple installs with a single database
- How turn on error reporting without reset?
- WordPress installed on a Sub-directory
- Editing wp-config.php file asks for another installation
- $post->id vs $post->ID problem after using WordPress config bootstrap
- How to stage a redesigned site on a new webhost while the original site is still live? [closed]
- WordPress login redirection not working on Nginx root directory
- Plesk login inaccessible after changing site URL
- Need help re-connecting local WP-config file to local database
- Change of “home” results in timeouts (only on index.php)
- wp-config.php randomly will reset to wp-config-sample.php
- WP_SITEURL vs WP_HOME link output
- What can an attacker do if he has access to my wp-config file?
- How to fix wp-login.php gives error 500 after migration?
- Change default wordpress FS owner
- Define new constants in wp-config
- sudden changing of host IP result in crash of the site
- Move wp-content outside root
- Can you define readability settings in wp-config.php?
- Can wp-config move cause dashboard not to load?
- Unable to change WordPress language (WordPress 4.2.2)
- How to change WordPress theme file path to a remote server?
- Why is WordPress not using $_SERVER[‘SERVER_NAME’] for ‘WP_SITEURL’ and ‘WP_HOME’ as default?
- WordPress Redirect on Name Change
- Is there any reason why using the same wp-config file might not work in MAMP?
- Best function/method to access wp-config?
- WordPress still requires FTP information
- “Cannot modify header information” warning?
- Why would changing ports from 80 to 8080 cause wordpress to act unexpectedly?
- Change URL when visiting wordpress site
- max_input_vars not updating through wp-config
- Disabling zlib compression and enforcing gzip
- Can WP-CLI modify database connection details in existing wp-config file?
- How to specify server path in code?