Title: wp-config security
Last modified: December 3, 2019

---

# wp-config security

 *  [Alwin](https://wordpress.org/support/users/wp-opti/)
 * (@wp-opti)
 * [6 years, 8 months ago](https://wordpress.org/support/topic/wp-config-security-2/)
 * I am in the proccess of making my wp-config files more secure. I already added
   this code to my .htaccess files, to o deny access to wp-config:
 * # protect wpconfig.php
    <files wp-config.php> order allow,deny deny from all 
   </files>
 * Now I like to know if it is a good idea to also change the file permissions for
   wp-config from 600 (actual setting) to 400?
 * Or is it not necessary anymore to change the file permission because of the code
   I added to the .htaccess file?
 * And when I change the permission to 400 and I want to change anything in the 
   wp-config file in the future, I have to change it back to 600 first, correct?
 * Thank you for your help 🙂

Viewing 2 replies - 1 through 2 (of 2 total)

 *  [Tyler](https://wordpress.org/support/users/tylerthedude/)
 * (@tylerthedude)
 * [6 years, 8 months ago](https://wordpress.org/support/topic/wp-config-security-2/#post-12196411)
 * Hi there,
 * There isn’t a need to change the file permissions on the wp-config.php file, 
   so I’d recommend just leaving the permissions set on the file to the default.
   The .htaccess code you provided above is essentially locking down the wp-config.
   php file so no other sources can reach it. However, I’d like to point out that
   some plugins (caching for example) may attempt to add code to the wp-config.php
   file and that code may block them from inserting code into the file. If this 
   is the case, make sure you temporarily remove the .htaccess code protecting the
   file before installing any plugins that may attempt to write to it.
 * Regards,
    Tyler
 *  [Dion](https://wordpress.org/support/users/diondesigns/)
 * (@diondesigns)
 * [6 years, 8 months ago](https://wordpress.org/support/topic/wp-config-security-2/#post-12197055)
 * .htaccess files have zero effect on the ability of a plugin (or any PHP script)
   to read/write wp-config.php. Protecting wp-config.php from web access is useful
   if you’re using a plugin that added some really stupid code to it.
 * However there is ZERO benefit to messing with file permissions if the webserver
   has a modern configuration. If WordPress itself can access wp-config.php, then
   a rogue script can as well, and the rogue script can do a `chmod()` to restore
   write access. If you are that concerned about wp-config.php, then take the “nuclear
   option” == keep its permissions at 0644 and change its ownership to the root 
   user. This insures no one other than the root user will be able to make changes
   to wp-config.php.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘wp-config security’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 2 replies
 * 3 participants
 * Last reply from: [Dion](https://wordpress.org/support/users/diondesigns/)
 * Last activity: [6 years, 8 months ago](https://wordpress.org/support/topic/wp-config-security-2/#post-12197055)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics