Case: wp-config Hardening Blocked a Live Disclosure Attempt

Case: wp-config Hardening Blocked a Live Disclosure Attempt
During an audit, wp-config.php was world-readable and the DB user had full GRANT ALL.

Hardening SOP:

— Step 1: chmod 600 wp-config.php, owner = the PHP user only.
— Step 2: Move wp-config.php one directory above webroot.
— Step 3: Add define('DISALLOW_FILE_EDIT', true); to kill the in-dashboard editor.
— Step 4: Rotate all 8 salts via the WordPress secret-key API.
— Step 5: Cut the DB user to SELECT, INSERT, UPDATE, DELETE — revoke DROP, GRANT, FILE.

Outcome: A path-traversal probe two days later tried to read wp-config.php and returned 403. Rotating salts forced all 31 active sessions to re-auth, evicting any pre-existing hijack.

Run this every time.