Hacked wp-config.php: What Site Owners Should Check

wp-config.php holds the database credentials and the keys that secure login sessions. If an attacker could read it, those secrets are compromised. If they could change it, they can run code on every page load. Both are worth checking after any incident.

What the file contains

• Database name, user, password and host
• Authentication keys and salts, which secure login cookies
• The table prefix
• Debug settings and any custom constants your host or plugins add

Anyone who can read the file can connect to the database and, depending on the host's setup, do far more than your WordPress login allows.

Signs it was modified

• Code that isn't a define() or $table_prefix: extra include/require lines, or very long strings of random-looking characters.
• Anything before the opening <?php tag or after the closing section, such as a block of code at the very top or bottom of the file.
• Constants you don't recognise, especially ones that change the site URL or load files from unusual paths.
• A modification date that doesn't match when you last edited it.

A genuine wp-config.php is short and readable. If you can't explain a line, compare it against a clean template and ask your host or developer before deleting it.

What to look at around the file

• Permissions. Set as restrictive as your host allows, so other accounts on the server can't read it. Your host can tell you the right values for the setup.
• Location. WordPress also finds wp-config.php one folder above the web root, which keeps it out of the public directory. Check whether your host supports that.
• Web access. Confirm the file's contents can't be downloaded: https://yourdomain.com/wp-config.php should show a blank page, not source code.
• Debug mode. WP_DEBUG should be off on a production site, and debug output shouldn't be displayed publicly.
• File editor. Consider adding define( 'DISALLOW_FILE_EDIT', true ); so the dashboard can't edit plugin and theme code.

What to rotate afterwards

If there's any chance the file was read or changed, treat its secrets as exposed:

1. Database password. Change it in the hosting panel, then update wp-config.php.
2. Salts and keys. Replace all eight values. WordPress.org offers a generator at https://api.wordpress.org/secret-key/1.1/salt/; with WP-CLI, wp config shuffle-salts does it. All users are logged out.
3. Everything else on the account: hosting panel, SFTP/SSH and email accounts, from a clean computer.

Then find how it was reached

A changed wp-config.php means the attacker had write access, which usually means a deeper compromise. Work through the WordPress Malware Cleanup Checklist, and see WordPress Backdoors: How Reinfection Happens for persistence. If you would like the investigation done for you, see malware removal. The overall approach is in the The Complete WordPress Hacked Site Recovery Guide.