WordPress Security - Secure Your WordPress wp-config Info!

Here is a quick and easy way to add a little more security to your WordPress Blog.

Remember that blog security is often a matter of tweaking little things to make it harder to compromise your blog, and thus encouraging the bad guys to go try some one else's site. Just like a car alarm doesn't actually make taking a car impossible, it makes taking this car a little less attractive. I'm not sure how great it is for your karma to think of it in terms of encouraging them to go hack some one else, but I can tell you it's great for security.

One item of note is that the WordPress file wp-config.php is an open text based file in a web accessible directory. Not only is it web accessible, but it contains the login and password for your blog's database.

Since many other files within the WordPress core code call this file, it is impractical to move the file itself to a more secure location. And since other parts of the code need to read the information in this file to be able to retrieve your blog's data from the database, you can't just encrypt it either.

What you can do, though, is move the sensitive information inside the file to another location.

Here is the code from the wp-config-sample.php distribution file.

[php]
< ?php
// ** MySQL settings ** //
define('DB_NAME', 'putyourdbnamehere'); // The name of the database
define('DB_USER', 'usernamehere'); // Your MySQL username
define('DB_PASSWORD', 'yourpasswordhere'); // ...and password
define('DB_HOST', 'localhost'); // 99% chance you won't need to change this value
define('DB_CHARSET', 'utf8');
define('DB_COLLATE', '');

// You can have multiple installations in one database if you give each a unique prefix
$table_prefix = 'wp_'; // Only numbers, letters, and underscores please!

// Change this to localize WordPress. A corresponding MO file for the
// chosen language must be installed to wp-content/languages.
// For example, install de.mo to wp-content/languages and set WPLANG to 'de'
// to enable German language support.
define ('WPLANG', '');

/* That's all, stop editing! Happy blogging. */

define('ABSPATH', dirname(__FILE__).'/');
require_once(ABSPATH.'wp-settings.php');
?>
[/php]

Lines 3, 4 and 5 contain the really sensitive info, the info about how to get into your database. Line 11 can also be critical because there are some WordPress Security Exploits that require the attacker to know what your table names are.

But since we don't want to make this too complicated, and it doesn't really matter, from a program standpoint, where this information is stored, so long as it can be retrieved, we'll just grab everything from line 2 through line 11 and cut it from the wp-config.php file.

Now, don't just throw this information away, because we still need it. We are going to create a new file to keep this information in.

to make the new file, follow these steps.

• Open: A new blank text document.
• Type: <?php
• Hit: [enter]
• Paste: The lines 2 - 11 that you cut from the wp-config.php file.
• Hit: [enter]
• Type: ?>
• Hit: [delete] a few times to ensure there are no new lines or spaces at the end of the file.
• Save: the file as config-info.php

That's it. Now you have a new file that contains all of the sensitive information about your WordPress Blog database. it will look like this.

[php]
< ?php
// ** MySQL settings ** //
define('DB_NAME', 'putyourdbnamehere'); // The name of the database
define('DB_USER', 'usernamehere'); // Your MySQL username
define('DB_PASSWORD', 'yourpasswordhere'); // ...and password
define('DB_HOST', 'localhost'); // 99% chance you won't need to change this value
define('DB_CHARSET', 'utf8');
define('DB_COLLATE', '');

// You can have multiple installations in one database if you give each a unique prefix
$table_prefix = 'wp_'; // Only numbers, letters, and underscores please!
?>
[/php]

Now back to the wp-config.php file. We're going to replace those lines we cut with a simple php include(); statement.

Before we can write that include statement, we'll need to figure out where the new file we made will live. In most hosting environments your WordPress will be installed under a folder called 'public_html'. This is the first web accessible folder for your site. Folders 'above' this one are generally not accessible by anyone on the web.

Most hosts have this structure.

/home/username/public_html/

What we want to do is store the new config-info.php in the /username/ level folder (or make a new folder there and store the file in it).

Now that we have saved our config-info.php we have a path to use in an include(); statement.

It will be /home/username/config-info.php

So our new wp-config.php file looks like this.

[php]
< ?php
// Get database info
include('/home/username/config-info.php');

// Change this to localize WordPress. A corresponding MO file for the
// chosen language must be installed to wp-content/languages.
// For example, install de.mo to wp-content/languages and set WPLANG to 'de'
// to enable German language support.
define ('WPLANG', '');

/* That's all, stop editing! Happy blogging. */

define('ABSPATH', dirname(__FILE__).'/');
require_once(ABSPATH.'wp-settings.php');
?>
[/php]

This just tells wp-config.php to grab the info from the new file so that the file that called it in the first place will have access to it. Save your new wp-config.php file and you are done.

There is nothing here that's NSA / Fort Knox level security, but it really is these little things that add up and make it harder, and thus less desirable, to attack your blog.

What did you think of this article? Was it helpful? Do you already do this? Do you plan to implement it? Hit the comment form below and let me know! if you found this post helpful please consider rating it, or sharing it with others.