Secure wp-config.php by Moving It Outside Public Root

Most WordPress users leave their site configuration exactly how it was installed by default. In a standard setup, your wp-config.php file sits right inside the public_html folder. While this is convenient for beginners, it exposes your most sensitive data, including database usernames and passwords, to potential attackers if your server is misconfigured or suffers from a local file inclusion vulnerability.

The goal of a security hardened site is to reduce the attack surface. When you move wp-config.php outside public html, you are effectively placing your site’s “master key” in a room that the public cannot enter. Even if a hacker finds a way to browse your public folders, they cannot reach the directory above it, making it significantly harder to steal your database credentials.

This guide will walk you through the technical process of relocating this file. It is an advanced move, so you will need access to your hosting control panel or FTP client. Before starting, ensure you have a full backup of your website, as a single typo in the file path can take your site offline temporarily.

Why You Should Move wp-config.php Outside Public HTML

The wp-config.php file is the heart of your WordPress installation. It contains the DB_NAME, DB_USER, and DB_PASSWORD. If a malicious actor manages to read this file through a security hole, they have full access to your database. They could delete your content, create new admin users, or steal customer data.

By default, WordPress is designed to look for this file in the root directory. However, the software is smart enough to look one level up in the directory tree if it does not find the file in the public folder. This built-in feature allows us to hide the file where the web server cannot serve it as a public page.

Consider a scenario where a plugin has a vulnerability that allows a user to read arbitrary files on the server. If the config file is in the public root, it is a primary target. If it is moved outside the public root, the attacker would need much deeper system access to find it. This adds a critical layer of defense in depth.

Comparing Default Setup vs. Secured Setup

To understand the difference, look at how the file paths change on your server. In a standard setup, everything is lumped together. In a secured setup, sensitive logic is separated from public assets.

Step by Step Guide to Relocate Your Config File

Moving the file is a straightforward process, but you must be precise. If you move the file and the site crashes, do not panic. You can simply move it back to restore functionality. Follow these steps carefully using an FTP client like FileZilla or the File Manager in cPanel.

Step 1: Locating the Public Root

First, log into your hosting account. Navigate to the File Manager. You will see a folder typically named public_html, www, or httpdocs. This is your public root. Everything inside this folder can be accessed by a browser if the right URL is known. Your wp-config.php file is currently sitting right here.

Step 2: Moving the File

Right click on the wp-config.php file and select Move. When the system asks for the destination path, you want to move it one level up. For example, if your path is /home/username/public_html/wp-config.php, you should move it to /home/username/wp-config.php.

Once moved, the file will be sitting outside the folder that the web server uses to serve your website. At this point, WordPress will automatically search one directory above the root. If it finds the file there, it will load it without any further configuration.

Step 3: Testing the Connection

Open your website in a private browser window. Refresh the homepage and try logging into the admin dashboard. If the site loads normally, WordPress has successfully found the file in the parent directory. If you see an “Error Establishing a Database Connection,” it means the file was moved to the wrong location or the permissions are incorrect.

Note: If you are using a managed WordPress host, some environments may restrict moving files outside the root. In such cases, you may need to contact your support team or use website security services to implement alternative hardening methods.

Advanced Hardening After Moving the File

Moving the file is a great start, but security is an ongoing process. Once you have successfully managed to move wp-config.php outside public html, you should consider additional steps to lock down the server environment.

Changing File Permissions

Even though the file is outside the public root, it should still have restrictive permissions. You do not want other users on a shared server to be able to read your config file. Set the permissions for wp-config.php to 400 or 440. This ensures that only the owner can read the file and no one can write to it.

Adding Security Salts

While you are editing your configuration, ensure your authentication keys and salts are unique. These are the long strings of random characters in your config file. If you have moved your site from a staging environment to a live one, regenerate these salts using the official WordPress API. This invalidates all current cookies and forces users to log in again, preventing session hijacking.

Integrating Maintenance Routines

Security is not a one time event. You need to ensure your plugins and themes are updated regularly. A moved config file protects your database, but an outdated plugin can still allow an attacker to upload a shell to your server. This is why many business owners prefer website maintenance packages to keep everything patched and current.

Common Pitfalls to Avoid

While this process is simple, there are a few common mistakes that can cause downtime. Being aware of these will save you from unnecessary stress.

• Incorrect Directory Level: Do not move the file too far up. WordPress only looks one level above the root. If you move it two or three levels up, the site will fail to load.
• Permission Lockouts: If you set permissions to 000, the web server cannot read the file, and your site will crash. Always use 400 or 440 for maximum security without breaking functionality.
• Forgeting Backups: Never modify system files without a backup. If the move fails or the file gets corrupted during transfer, having a backup allows you to recover in seconds.
• Caching Issues: Sometimes, server side caching might show a cached version of the site. Always test in Incognito mode to ensure the live site is actually communicating with the relocated file.

The Impact on Site Performance

A common question among developers is whether moving the configuration file slows down the website. The answer is no. The time it takes for the PHP engine to look one directory up is measured in microseconds. It is an insignificant amount of time that will not affect your page load speed or your Core Web Vitals.

In fact, the trade off is heavily skewed in favor of security. You are gaining a significant amount of protection against common attack vectors for a cost that is effectively zero in terms of performance. For any professional site, this is a mandatory optimization.

Integrating General Security Strategies

Relocating the config file is just one piece of the puzzle. To truly secure a WordPress site, you need a holistic approach. You should combine this technique with other best practices.

1. Disable File Editing: Add define( 'DISALLOW_FILE_EDIT', true ); to your wp-config.php file. This prevents anyone from editing theme or plugin files directly from the dashboard.
2. Limit Login Attempts: Use a security plugin to block IP addresses that fail to log in multiple times.
3. Use Strong Passwords: Database passwords should be long, complex, and changed periodically.
4. Professional Audits: Periodically visit Ewallz Solutions to explore how comprehensive audits can find holes in your security that manual tweaks might miss.

Summary

Learning how to move wp-config.php outside public html is a fundamental step for anyone serious about WordPress security. By relocating this sensitive file to the parent directory, you ensure that your database credentials are not accessible via a web browser. This simple shift in file structure creates a barrier that protects your site from various server side vulnerabilities.

Remember to always back up your files first, set the permissions to 400 or 440, and test your site thoroughly. When combined with regular updates and professional maintenance, this technique provides a robust defense for your digital assets.

You Might Be Wondering (FAQ)

Will moving wp-config.php break my plugins?

No, it will not break your plugins. Plugins interact with the WordPress core, and the core handles the loading of the configuration file. As long as the file is placed exactly one level above the public root, everything will function as normal.

Can I do this on shared hosting?

Yes, most shared hosting providers using cPanel or Plesk allow you to move files to the home directory, which is one level above public_html. However, a few highly restrictive hosts may block this. If you cannot see the directory above public_html, contact your host.

Do I need to change any code inside the file?

No, you do not need to edit the contents of the wp-config.php file to move it. WordPress is programmed to automatically check the parent directory if the file is missing from the root folder.

What happens if I move it and get a white screen?

A white screen usually indicates a fatal error. This happens if the file was moved to the wrong folder or if the permissions are too restrictive for the server to read. Simply move the file back into the public_html folder to restore the site immediately.

Is this better than using a security plugin?

It is a different type of protection. Security plugins often work at the application level (blocking IPs, scanning for malware), while moving the config file is a server level protection. For the best results, you should use both methods together.