Learn to Deny Access to Your wp-config.php File Under WordPress Installation

Protecting the wp-config.php file in your WordPress installation is crucial for your website’s security. This file contains your database credentials, security keys, and other sensitive information. Here’s how you can deny access to this file:

1: Using .htaccess (for Apache Servers)

1.Locate the .htaccess File:

- The .htaccess file is usually located in the root directory of your WordPress installation.

- If you don’t see it, it might be hidden. Ensure that your file manager or FTP client is set to show hidden files.

2. Edit the .htaccess File:

• • Open the .htaccess file using a text editor.

  • Add the following code to the file:

                     order allow,deny

                     deny from all

3. Save the Changes:

            Save the file and upload it back to the root directory if you edited it locally.

4. This code instructs the server to deny access to the wp-config.php file from any web request, effectively blocking anyone from viewing or downloading it.

2: Using Nginx (for Nginx Servers)

If your website is running on a Nginx server, you need to update the server configuration file.

1. Locate the Nginx Configuration File:

The configuration file is usually located at /etc/nginx/nginx.conf or /etc/nginx/sites-available/default.

2. Edit the Configuration File:

• • Open the Nginx configuration file in a text editor.

  • Add the following location block inside the server block:

            location ~* wp-config.php {

           deny all;

            }

3. Restart Nginx:

fter saving the changes, restart Nginx to apply the new configuration:

                     sudo systemctl restart nginx

This will block access to the wp-config.php file in the same way as the .htaccess method for Apache.

3: Move wp-config.php to a Non-Web Accessible Directory

Another method is to move the wp-config.php file to a directory that is not accessible via the web.

1. Move wp-config.php:

Move the wp-config.php file one level up from your WordPress root directory.

2. Update the File Path:

WordPress will automatically recognize the file in its new location. No additional changes are needed in most cases.

If necessary, you can create a new wp-config.php file in the original location with the following line to point to the moved file:

Summary

By denying access to your wp-config.php file using any of these methods, you can significantly increase the security of your WordPress site. Always remember to back up your site before making changes to server configurations.