Securing Your wp-config.php File

The Keys to the Kingdom

Your wp-config.php file contains your database credentials, security salts, and crucial configuration settings. If an attacker gains access to this file, they own your site.

How to Protect It

1. Move it up one level: Did you know you can move your wp-config.php file one directory above your WordPress installation (e.g., outside public_html)? WordPress will automatically look for it there, but web browsers cannot access it.
2. Set Strict Permissions: The file permissions should be set to 400 or 440. This means the file can be read by the server, but cannot be modified.
3. Deny Access via .htaccess: Add rules to your .htaccess file to explicitly block all web requests to wp-config.php.

Implementing these simple steps drastically reduces your attack surface.