Why It Matters

The wp-config.php file contains sensitive database credentials and encryption keys. Exposed debug logs expose database queries and file paths to automated web scanners.

  • Strict File Permissions: Set server file permissions on wp-config.php strictly to 600 or 640.

  • Configure Production Debug Flags: In wp-config.php, set debug display flags to false:

define( 'WP_DEBUG', false );
define( 'WP_DEBUG_DISPLAY', false );
define( 'WP_DEBUG_LOG', false );
define( 'SCRIPT_DEBUG', false );

Block Web Access via Server Rules

Block public web access to configuration and log files via .htaccess or Nginx server rules.

Move File Above Web Root

Where hosting permits, move wp-config.php one directory level above the public HTML web root to prevent direct web scraping entirely.