security overkill and the wp_config.php file

  • Resolved cranky123

    (@cranky123)


    13 years, 4 months ago

    Hello again, I have been searching google for the best way to secure the wp_config.php file. Since I installed wordpress in the root of my acct I can’t “go up a level”, so what’s an old crank to do? Well I found 2 answers but I don’t know which (if either) is best or will even work…so here they are:

    Option 1)just move the file out of the public_html directory. So it would go from: ~/home/user/public_html/wp-config.php to ~/home/user/wp-config.php
    more info at https://lifehacker.com/5832976/make-wordpress-more-secure

    That was the easier way.

    Option 2)Create a new folder (call it “secretstuff”) on the same level as the public_html folder.Copy the wp_config.php and .htaccess files to the new directory and rename that config.php to futurama-fan-fic.php that effectively hides the file but wp can’t find it! So, edit the original wp-config.php files in public_html and www directories – you want to replace everything in them with:
    <?php
    include(‘/home/usr/secretstuff/futurama-fan-fic.php’);
    ?>
    so now the wp_config.php files in public_html and www directories point to the “real wp_config file” that is now called futurama-fan-fic.php and is found in the secretstuff directory.
    a much better explaination with pictures is at https://www.groovypost.com/howto/howto/improve-wordpress-securitty-wp-config-php-location/

    Will either way work ok?

Viewing 3 replies - 1 through 3 (of 3 total)

  • I do option 1 all the time for folks

    Hi,

    As Sam said, option one works well. The file, since it is outside of the public_html folder in inaccessible by a web browser. Option 2 seems to sound as if it would work, and essentially does the same thing. It places the wp-config file outside of the public’s view and changes the name of the config file. Ideally, anyone finding the original file, could essentially see where you have stored your “secret” files.

    I hope this provides some insight.

    Thanks!

    Tim S

    Thread Starter cranky123

    (@cranky123)

    Thanks for the reply’s. I will go with just moving the file out of the public_html directory.

    Thanks again for the advice.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘security overkill and the wp_config.php file’ is closed to new replies.

Tags