Safe to store SMTP password in wp-config.php?

I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.

If your setup looks like: (And your public website lives inside of public_html)

/home/user/public_html/
  \__ wp-config.php

I would store a file in: (Which is not public facing at all)

/home/user/smtp-connect.php

And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.

The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/

Related Posts:

  1. If I change the salt keys in my wp-config will all passwords break?
  2. How secure is a wp-config file?
  3. How to change user password with wp-cli?
  4. Loosen/disable password policy
  5. Password Protect Custom Page
  6. Password protecting a page
  7. How to save Admin FTP password
  8. How can I change the default wordpress password hashing system to something custom?
  9. Conditional to test if post has password protection enabled
  10. Check the password of a user
  11. How to add Wp_error using lostpassword_post hook when validating custom field?
  12. Duplicate hash method for password in .NET
  13. Hide password protected posts
  14. How to set up gmail SMTP in WordPress
  15. Reseting admin password through PHPMyadmin fails
  16. Check Password Reset Key Not Woking
  17. Reset password – set minimum length for new password
  18. How to shorten length of auto generated password sent during registration?
  19. Forgot password not working
  20. wp_hash_password unexpected behaviour
  21. Redirect a password protected page?
  22. Lost password link is redirecting to /shop/my-account/lost-password/
  23. Change default recovery link expiration time
  24. Set content type to HTML for lost password email only
  25. Custom password generator for users
  26. Password protecting template, secured content not showing if even password is right
  27. Make post password required to publish
  28. WordPress reset password returns invalid key
  29. Add error message on password protected pages
  30. Password reset bug? – “Sorry, that key does not appear to be valid”
  31. How to set minimum length and error message for password recovery?
  32. Why is resetting the WordPress Users password not working?
  33. Get plain password on register
  34. How Authentication in wordpress works? wp_authenticate_username_password()
  35. Password Protected page not asking for a password
  36. I would like to password protect my entire WordPress site (ip validated), except for one page
  37. Custom login form for front-end user as well as admin
  38. how to remotely check a username / password from within a plugin
  39. Password changed [duplicate]
  40. Enable Update button only when password is shown strong
  41. How to get user password before being encrypted outside the wordpress core once add a new user from dashboard?
  42. wp_hash_password create a different hash everytime
  43. How to change password
  44. Generating the password reset link automatically
  45. Password protect pages – allow more than one password
  46. password recovery key is invalid on custom reset
  47. Like to store multiple passwords in db table wp_posts field post_password?
  48. Password Protected Post is invisible until you login
  49. Custom form for password protected page
  50. How to check user’s password?
  51. How to Remove or Deactivate “Application Passwords” in WordPress
  52. What’s the algorithm to verify user password?
  53. Customize retrieve password message
  54. How to recover password from a user
  55. resend user login & password with custom button
  56. WordPress admin creation through phpmyadmin not working
  57. Why does hashing a password result in different hashes, each time?
  58. How to initiate password reset flow by code
  59. Change password fields
  60. lostpassword_redirect filter is not used
  61. How to read third party cookie to access password protected pages
  62. Password Protect or IP to access under development WordPress site otherwise shown a placeholder page
  63. Password-protected page redirecting to frontpage when I enter the password
  64. How would I create a Password Protected Page with Content on it?
  65. wordpress custom password change problem
  66. Allow all reset password links within the past 24 hours to be valid and accepted
  67. WooCommerce Lost Password reset goes to 404
  68. Set id and password for each post
  69. I have to reset the admin password each time
  70. I need help with wp_lostpassword, wp_register and wp_login_form
  71. Create Member who can’t be changed
  72. Automatically change the page password for more than one page
  73. Sending Reset Password email via Web API
  74. $expiration_duration = apply_filters( ‘password_reset_expiration’, DAY_IN_SECONDS );
  75. Frontend custom forgot password page
  76. Entering a WP site with a SMS code
  77. Problem with login / reset password links in users emails
  78. Password Protect content() on homepage
  79. Function called by password_reset action passed only 1 argument instead of 2 in PHP 7.2.11
  80. Allow users from my ASP.Net MVC site to access my private WordPress site
  81. Lost Password redirect to My Account
  82. Multiple pages protected by different passwords. Possible to track multiple passwords at a time?
  83. How do I display the password field on the WordPress user registration screen?
  84. WordPress Protected Page Redirects to PDF
  85. Not able to log for the first time on a salted WordPress by creating pwd on BD
  86. Bypass a WordPress Password Protected Post or Page via a URL
  87. Password Protected Logout Button Not Working
  88. How do I password protect a page of posts on WordPress?
  89. forgot password
  90. Revise my keyword but still cannot login
  91. WordPress not taking password and username
  92. mysql update user’s password and activation key
  93. How WordPress hashes passwords
  94. Reset Password – change from name and email address. It stucks at admin. Want to change it to info
  95. check if post is set to “password protected”
  96. Override the default password length when creating or updating a user profile
  97. Why can’t I create an Application Password?
  98. ‘random_password’ filters not taking effect
  99. Bypass a WordPress Password Protected Page via url
  100. My WordPress password for admin account is changing automatically

Leave a Comment