wp-config security

  • Alwin

    (@wp-opti)


    6 years, 8 months ago

    I am in the proccess of making my wp-config files more secure. I already added this code to my .htaccess files, to o deny access to wp-config:

    # protect wpconfig.php
    <files wp-config.php>
    order allow,deny
    deny from all
    </files>

    Now I like to know if it is a good idea to also change the file permissions for wp-config from 600 (actual setting) to 400?

    Or is it not necessary anymore to change the file permission because of the code I added to the .htaccess file?

    And when I change the permission to 400 and I want to change anything in the wp-config file in the future, I have to change it back to 600 first, correct?

    Thank you for your help 🙂

Viewing 2 replies - 1 through 2 (of 2 total)
  • Tyler

    (@tylerthedude)

    6 years, 8 months ago

    Hi there,

    There isn’t a need to change the file permissions on the wp-config.php file, so I’d recommend just leaving the permissions set on the file to the default. The .htaccess code you provided above is essentially locking down the wp-config.php file so no other sources can reach it. However, I’d like to point out that some plugins (caching for example) may attempt to add code to the wp-config.php file and that code may block them from inserting code into the file. If this is the case, make sure you temporarily remove the .htaccess code protecting the file before installing any plugins that may attempt to write to it.

    Regards,
    Tyler

    Dion

    (@diondesigns)

    6 years, 8 months ago

    .htaccess files have zero effect on the ability of a plugin (or any PHP script) to read/write wp-config.php. Protecting wp-config.php from web access is useful if you’re using a plugin that added some really stupid code to it.

    However there is ZERO benefit to messing with file permissions if the webserver has a modern configuration. If WordPress itself can access wp-config.php, then a rogue script can as well, and the rogue script can do a chmod() to restore write access. If you are that concerned about wp-config.php, then take the “nuclear option” == keep its permissions at 0644 and change its ownership to the root user. This insures no one other than the root user will be able to make changes to wp-config.php.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘wp-config security’ is closed to new replies.