How to Secure wp-config and .htaccess for WordPress Hosting

Disclosure: We’re reader-supported. When you buy through links on our site, we may earn an affiliate commission at no extra cost to you. For more information, see our Disclosure page. Thanks.

Byte & 🦉 Beak Talk Hosting #79: How to Secure wp-config and .htaccess for WordPress Hosting

Beak leaves them open. Byte locks down sensitive files.

🎬 Scene Opener:

🦉 Beak: “Byte, I was exploring my WordPress files and saw something called wp-config.php. I poked it a bit… now I can’t access my site. Also, I may have renamed .htaccess to .htaccess-BEAK-EDIT…”

👨‍💻 Byte: “GASP You just exposed your database login credentials and broke your server routing logic… at the same time.”

🦉 Beak: “I’m securing my site with curiosity!”

👨‍💻 Byte: “You’re securing it like a squirrel secures a power station. Let me teach you how to lock down wp-config.php and .htaccess before Google lists your database password in search results.”

🧠 What Are wp-config.php and .htaccess?

These two files are the vault and the gatekeeper of your WordPress website:

• wp-config.php holds your database credentials, secret keys, and site configuration.
• .htaccess controls URL rewrites, access permissions, and server behavior (especially on Apache-based hosts).

🔐 If either file is exposed, hacked, or misconfigured, it’s like leaving your front door open with your bank PIN on a sticky note.

🚨 Why It Matters

Here’s why you must secure these files ASAP:

✅ Protect Database Access
Your wp-config.php file contains the keys to your WordPress kingdom.

✅ Prevent Code Injection
Poorly secured .htaccess files can allow malicious redirects, backdoors, or even remote code execution.

✅ Stop Bots and Exploits
Securing these files can prevent automated scanners from probing your site’s structure or vulnerabilities.

✅ Compliance and Trust
Keeping customer data secure is essential for GDPR, HIPAA, and just plain trustworthiness.

🧰 Byte’s Hosting Security Checklist

👨‍💻 “Beak, before you rename anything, go through this checklist. No poking, just securing.”

1. 🗄️ Move wp-config.php One Level Above

✅ Move wp-config.php out of your public_html root (if your host allows).
For example:
/home/username/wp-config.php ← Safe
/home/username/public_html/wp-config.php ← Risky

WordPress will still find it if moved one level above.

2. 🧱 Block Web Access to Sensitive Files

In your .htaccess, add:

apacheCopyEdit<Files wp-config.php>
  order allow,deny
  deny from all
</Files>

Also block .htaccess itself:

apacheCopyEdit<Files .htaccess>
  order allow,deny
  deny from all
</Files>

🔒 This prevents hackers from downloading or reading these files directly.

3. 🔁 Backups Before Changes

🦉 Beak: “What if I break it again?”

👨‍💻 Byte: “Then we use a backup like responsible nerds.”

Use your host’s backup system or a plugin like UpdraftPlus. Make full backups before editing core files.

4. 🛡️ Secure with File Permissions

Change file permissions using cPanel, FTP, or SSH:

• wp-config.php — 400 or 440
• .htaccess — 444

This ensures these files are readable by the server but not writable by others.

5. 🧪 Test for Errors Immediately

Don’t wait for visitors to tell you your site’s broken. After each change:

• Refresh your homepage
• Try logging in
• Check pretty permalinks
• Test form submissions

💡 Real-Life Example: The Curious Case of Beak’s Broken Redirects

🦉 Beak: “One time, I added a redirect to .htaccess like this…”

apacheCopyEditRedirect /old-page.html https://mynewsite.com/new-page/

🦉 “…but suddenly my site redirected everything to that new page! Even the admin login!”

👨‍💻 Byte: “Classic unscoped redirect. That’s why you test in a staging environment first.”

🦉 Beak: “I did. I tested it… live.”

🚀 Hosting That Helps Secure Your WordPress Files

🧩 Many shared hosts don’t secure wp-config.php by default or let you move it. Byte recommends these security-first hosts:

🔗 Use Ultahost

Offers auto-secured configs and permissions locked out-of-the-box.

🔗 Try Unihost

SSH access, mod_security firewall, and easy .htaccess editor.

🔗 Use Verpex Hosting

Includes daily malware scans and hardened Apache config.

🔍 Byte’s Takeaways

👨‍💻 “Let’s summarize for Beak’s brain…”

✅ Move wp-config.php one level up (if supported)
✅ Block public access in .htaccess
✅ Use read-only permissions (400/444)
✅ Never test live — use staging
✅ Back up before you edit
✅ Don’t rename core files unless you’re Byte or Batman

🦉 Beak’s Final Hoot

🦉 “Byte, I now have .htaccess, .htaccess-secure, .htaccess-v2, and .htaccess-do-not-touch.”

👨‍💻 “You’ve got a security system made of file name spaghetti.”

🦉 “But at least I didn’t rename wp-config.php to wp-confused.php this time!”

➡️ Next Up: Byte & 🦉 Beak Talk Hosting #80: How to Set Up Google Analytics on Your Hosted Site

Beak wants to count visitors. Byte installs tracking the right way.