Sensitive Files
wp-config.php File Access Check
The wp-config.php file contains your database credentials. Verify it is not publicly accessible and learn how to secure it effectively.
What this test checks
This test checks whether the wp-config.php file is publicly accessible. This file contains WordPress database connection credentials, security keys, and configuration settings. Its exposure allows an attacker to take full control of your site, steal data, or inject malware.
Our recommendation
Ensure the wp-config.php file is placed above your site's public directory. If not possible, configure your server to block access to this file. Use restrictive permissions (chmod 600 or 640) and add a rule in your .htaccess (or Nginx configuration) to deny direct access. Verify that the file is not visible in a browser.
Security tests
Read more
CMS Security