Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is wp-config.php Hardening?

Definition

wp-config.php hardening means protecting and tuning WordPress's main configuration file. wp-config.php holds the database name, username, and password, plus the secret keys and salts that sign login cookies. Hardening limits who can read it and uses its settings to switch off risky features.

How It Works

Hardening has two halves: protecting the file, and using it to lock down the site.

Protecting the file. WordPress's hardening guide offers several steps:

  • Tight permissions. "Make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission)."
  • Block web requests to the file in .htaccess or the server config.
  • Move it one level up. WordPress can load wp-config.php from the directory above the install, outside the web root. The guide notes that some people say this has minimal benefit, so treat it as optional.

Settings that reduce risk. Constants in wp-config.php change how WordPress behaves:

  • DISALLOW_FILE_EDIT removes the theme and plugin code editor from the dashboard. WordPress notes this "will not prevent an attacker from uploading malicious files to your site, but might stop some attacks."
  • DISALLOW_FILE_MODS also blocks plugin and theme installs and updates from the dashboard, for sites updated by a managed process.
  • FORCE_SSL_ADMIN keeps logins and admin pages on HTTPS so "passwords and cookies are never sent in the clear."
  • Debug settings keep errors off public pages. WordPress warns that "placing error logs in publicly accessible locations is a security risk."
  • Unique keys and salts, rotated after any compromise, log out stolen sessions.

Real-World Example

In February 2020, attackers exploited a flaw in the Duplicator plugin, then on over 1 million sites, that let anyone download files from the server through directory traversal (CVE-2020-11738, fixed February 12 in version 1.3.28). Tenable, summarizing Wordfence research, reported over 60,000 blocked attempts to download wp-config.php this way, about 50,000 of them before the fix shipped. With that file, an attacker has the database password and keys needed to add an admin or alter content. CISA added the flaw to its Known Exploited Vulnerabilities catalog in November 2021.

Why It Matters for a Small Business

wp-config.php is the single most valuable file on a WordPress server. Whoever reads it can usually reach the database directly, which holds customer records, orders, and user accounts. Hardening will not fix a vulnerable plugin, but it shrinks what an attacker gets when something else fails. The settings take minutes to apply, and after any compromise, changing the database password and salts in this file is a required cleanup step. It is also a quick test of how carefully a site has been set up: a sloppy configuration file often means other shortcuts were taken too.

How to Spot It / How DTS Handles It

Warning signs: wp-config.php readable by every account on shared hosting, a copy such as wp-config.php.bak in the web root, a public debug.log, the theme editor still active, and default or never-changed keys and salts.

DTS reviews file permissions, removes stray copies and public logs, sets editor and SSL constants, and rotates database credentials and salts after incidents. See our WordPress maintenance service, or hacked WordPress help if the file may have been exposed.

Related Terms

  • WordPress salts and keys: the secrets stored in wp-config.php.
  • File permissions: who can read the file.
  • Directory traversal: the bug class behind the Duplicator downloads.
  • Plugin vulnerability: the usual route to the file.
  • Rogue admin user: what attackers often create with stolen credentials.
  • Eradication: rotating credentials and salts after a compromise.

Sources

  • WordPress.org, Hardening WordPress (Advanced Administration Handbook): https://developer.wordpress.org/advanced-administration/security/hardening/
  • WordPress.org, Editing wp-config.php (Advanced Administration Handbook): https://developer.wordpress.org/advanced-administration/wordpress/wp-config/
  • Tenable, Duplicator WordPress Plugin Vulnerability Exploited in the Wild (February 20, 2020; summarizing Wordfence research): https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
  • NIST NVD, CVE-2020-11738 (published April 13, 2020): https://nvd.nist.gov/vuln/detail/CVE-2020-11738

Last updated October 14, 2026.