files wp-config.php
order allow, deny
deny from all
/files

with the first and last time enclosed within

We’re talking of a basic include in PHP where you can reference the file.

include(‘/vhost/johndoe/private/wp-config.php’);

Very nice article covering some of the basics that all WP owners should follow. The new WP 3.0 lets you select how you want to name the admin user, I just hope that people will not chose admin or, worse, god. Hopefully we will also see the table prefix as part of the installation procedure.

I believe however that you forget one additional step that can further increase the security of any blog.

The most usual hack of a WordPress blog involves the file wp-config.php which is always located in the root of the installation. Someone being able to read that file will have full access to your blog, no matter how hard you try to protect it.

Almost all hosting scenarios, from a dedicated server to a sharing package, include a folder that is outside of the confins of the webserver (i.e. none can reach that folder from the web). The idea then would be to move the file wp-config.php to that folder and create a wp-config.php to replace it.

Say that you are in a typical shared package where your webserver full path is /vhost/johndoe/httpdocs/. Chances are that you have folders in /vhost/johndoe/ where you can put files, such as /vhost/johndoe/private/

So move your wp-config.php to /vhost/johndoe/private/wp-config.php and replace the original wp-config.php by the following code:

Nobody will be able to get access to your dB connection string from the web space.

For extra security, add the directive

order allow,deny
deny from all

to your .htaccess file

It’s a bit confusing. While admin, I created a new member and gave full administration privileges to it. Don’t delete admin just yet.

While still logged in as “admin” user go to Site Admin > Options. Scroll down near the bottom is Administration Settings. The field for this is Site Admins and you can remove the admin and replace it with your new administrator’s user name. If it was me, it would be michaelmarian instead of admin. Then you can try out the new account and if all is well delete the admin account.

The article does not mention what happens to the old password. Also, it cannot email my new password because it does not recognize something.

So it is a catch 22. My only way out is to delete BP and then reinstall it all over again.

Is there some part of the instructions that is going unsaid?

1. Can I do this after installing WPMU?

2. Would there be plugins that could be affected by this? I can’t think of any functions in plugins that could, but I’m just putting it out there.

3. Would I have to change it back after each upgrade?

I’m glad I’ve done this now.