WordPress 5 Cookbook

Securing database user accounts

WordPress database access details are stored in the config file inside the root folder. We have to provide these details in the installation process. Generally, we set up the site with a user that has permissions to execute all types of operations in the database. These details can lead to major security threats in the following scenarios:

• Attackers gaining access to the wp-config.php file—if this file is not protected on your site, an external user has the ability to gain access to the details inside the file. Then, the attacker can easily modify the database by using the login details of database users unless there are additional layers of protection from the hosting server.
• Executing dangerous queries from ...