{"id":18928,"date":"2026-10-21T20:17:42","date_gmt":"2026-10-21T17:17:42","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/protect-wp-config\/"},"modified":"2026-10-21T20:17:53","modified_gmt":"2026-10-21T17:17:53","password":"","slug":"protect-wp-config","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/protect-wp-config\/","title":{"rendered":"How to Protect wp-config.php in WordPress: 7 Steps to Secure Your Most Important File"},"content":{"rendered":"
\n
In short<\/b>wp-config.php is the most important file in a WordPress site: it holds the database name, user, password and the keys that encrypt login sessions. Anyone who reads it can reach all your site\u2019s data. Protect it with 440 or 400 permissions, block browser access, change the security keys after any breach, disable the file editor and delete any copy saved with another extension.<\/div>\n
\"The<\/figure>\n

What does the file contain?<\/h2>\n
\n
DB<\/i>Database credentials<\/b>Database name, user, password and host.<\/span><\/div>\n
K<\/i>Security keys<\/b>AUTH_KEY and the other keys that encrypt login cookies.<\/span><\/div>\n
\u2699<\/i>Site settings<\/b>Table prefix, debug mode, update and memory settings.<\/span><\/div>\n<\/div>\n

7 steps to protect it<\/h2>\n
    \n
  1. Set permissions to 440 or 400:<\/b> In the cPanel File Manager select the file, then \u201cChange Permissions\u201d. On our servers PHP runs as the account owner, so the site can still read it. Read secure file permissions<\/a>.<\/li>\n
  2. Block browser access:<\/b> Add the rule below to your main .htaccess<\/code> file.<\/li>\n
  3. Change the security keys after any breach:<\/b> Generate new keys from the official WordPress generator api.wordpress.org\/secret-key\/1.1\/salt\/<\/code> and replace the old ones. This logs everyone out, including the attacker.<\/li>\n
  4. Disable the dashboard file editor:<\/b> Add define('DISALLOW_FILE_EDIT', true);<\/code> so anyone who gets into your dashboard cannot edit theme and plugin files from it.<\/li>\n
  5. Turn debug mode off:<\/b> Set WP_DEBUG<\/code> to false on a live site so file paths and errors are not shown to visitors.<\/li>\n
  6. Delete exposed copies:<\/b> A file such as wp-config.php.bak<\/code> or wp-config.old<\/code> is not run as PHP, so it may be readable as plain text with your password. Remove any copy like this from the site folder.<\/li>\n
  7. Use a strong database password:<\/b> If you suspect the file leaked, change it in cPanel and then update it in the file.<\/li>\n<\/ol>\n
    <Files wp-config.php>\n  Require all denied\n<\/Files><\/pre>\n
    Before editing:<\/b> save a copy of the file on your computer. A small mistake stops the whole site, and the copy restores it in seconds.<\/div>\n
    Can you move the file outside the site folder? WordPress also looks for it one folder up, but this does not suit every case, such as sites in subfolders. 440 permissions and blocked access are enough for most sites.<\/p>\n
    \n
    How Hyyat Host protects your site<\/h2>\n