WordPress Daily Routine

If misconfigured, wp-config.php may be exposed or browsable on certain servers.

Default wp-config.php Is Accessible

Key Points: The file that stores DB passwords and keys should be untouchable — but sometimes it’s exposed.

If your server doesn’t block direct access to wp-config.php, attackers can see your keys, salts, and credentials. That’s game over.

🚨 Signs of Trouble

• Server doesn’t auto-block config files
• Root path exposes directory contents
• File permissions allow public read access

🛠️ Lock It Down

1. Move wp-config.php one directory above web root if possible
2. Add this to .htaccess or nginx config:

   <Files wp-config.php>
     order allow,deny
     deny from all
    </Files>

3. Set file permission to 400 or 440

🧠 Pro Tip

wp-config.php is your nuclear codes — treat it like one.