Safe to store SMTP password in wp-config.php?Password in wp-config. Dangerous?2 accounts under same email preventing me from loging inWordpress SMTP EMailhow wordpress smtp works? my emailing is not workingwp-config.php being deletedSMTP Issues with Outlook 365SMTP connect() failedConfused over wp-config.php and 'database user + database password + name'Easy WP SMTP plugin test email failedHow can I configure an SMTP Server?can't submit mail from contact 7 form site using wp mail smtp
Find the closest three-digit hex colour
Why would Dementors torture a Death Eater if they are loyal to Voldemort?
Can I submit a paper to two or more journals at the same time?
Where can I find my serialized Sitecore items?
Why should I allow multiple IPs on a website for a single session?
Active wildlife outside the window- Good or Bad for Cat psychology?
What does 5d4 x 10 gp mean?
Is it possible to alias a column based on the result of a select+where?
Why wasn't ASCII designed with a contiguous alphanumeric character order?
Why are symbols not written in words?
Is leaving out prefixes like "rauf", "rüber", "rein" when describing movement considered a big mistake in spoken German?
Dynamic Sql Query - how to add an int to the code?
A quine of sorts
Checkmate in 1 on a Tangled Board
Early 2000s movie about time travel, protagonist travels back to save girlfriend, then into multiple points in future
What prevents a US state from colonizing a smaller state?
Automorphisms and epimorphisms of finite groups
How far can gerrymandering go?
Is it OK to throw pebbles and stones in streams, waterfalls, ponds, etc.?
Would skyscrapers tip over if people fell sideways?
Fast method to cut/shred glue stick into small pieces
Why was Pan Am Flight 103 flying over Lockerbie?
Can US Supreme Court justices / judges be "rotated" out against their will?
How does the 'five minute adventuring day' affect class balance?
Safe to store SMTP password in wp-config.php?
Password in wp-config. Dangerous?2 accounts under same email preventing me from loging inWordpress SMTP EMailhow wordpress smtp works? my emailing is not workingwp-config.php being deletedSMTP Issues with Outlook 365SMTP connect() failedConfused over wp-config.php and 'database user + database password + name'Easy WP SMTP plugin test email failedHow can I configure an SMTP Server?can't submit mail from contact 7 form site using wp mail smtp
I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php?
Very similar to this.
Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.
password wp-config smtp
edited Jun 21 at 16:57
Nicolai
15.6k7 gold badges38 silver badges89 bronze badges
asked Jun 21 at 15:47
RiccardoRiccardo
4478 silver badges27 bronze badges
add a comment |
I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php?
Very similar to this.
Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.
password wp-config smtp
edited Jun 21 at 16:57
Nicolai
15.6k7 gold badges38 silver badges89 bronze badges
asked Jun 21 at 15:47
RiccardoRiccardo
4478 silver badges27 bronze badges
add a comment |
I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php?
Very similar to this.
Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.
password wp-config smtp
edited Jun 21 at 16:57
Nicolai
15.6k7 gold badges38 silver badges89 bronze badges
asked Jun 21 at 15:47
RiccardoRiccardo
4478 silver badges27 bronze badges
I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php?
Very similar to this.
Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.
password wp-config smtp
password wp-config smtp
edited Jun 21 at 16:57
Nicolai
15.6k7 gold badges38 silver badges89 bronze badges
asked Jun 21 at 15:47
RiccardoRiccardo
4478 silver badges27 bronze badges
edited Jun 21 at 16:57
Nicolai
15.6k7 gold badges38 silver badges89 bronze badges
asked Jun 21 at 15:47
RiccardoRiccardo
4478 silver badges27 bronze badges
edited Jun 21 at 16:57
Nicolai
15.6k7 gold badges38 silver badges89 bronze badges
edited Jun 21 at 16:57
Nicolai
15.6k7 gold badges38 silver badges89 bronze badges
edited Jun 21 at 16:57
Nicolai
15.6k7 gold badges38 silver badges89 bronze badges
15.6k7 gold badges38 silver badges89 bronze badges
asked Jun 21 at 15:47
RiccardoRiccardo
4478 silver badges27 bronze badges
asked Jun 21 at 15:47
RiccardoRiccardo
4478 silver badges27 bronze badges
asked Jun 21 at 15:47
RiccardoRiccardo
4478 silver badges27 bronze badges
4478 silver badges27 bronze badges
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.
If your setup looks like: (And your public website lives inside of public_html)
/home/user/public_html/
__ wp-config.php
I would store a file in: (Which is not public facing at all)
/home/user/smtp-connect.php
And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.
The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/
answered Jun 21 at 17:08
ChristopherJonesChristopherJones
5438 bronze badges
2
Chapeau. We do this also already for years (storing thewp-config.phpfile in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty'wp-config.phpwhich has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials fromwp-config.phpin the regular spot will be exposed.
– Charles
Jun 21 at 18:38
This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.
– Nicolai
Jun 21 at 18:48
What if a malicious plugin accesses wp-config.php?
– Riccardo
Jun 21 at 18:55
I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.
– ChristopherJones
Jun 21 at 20:25
So to first step it might be storing the value in a non significative variable name, but any malicious plugin could scan all code in within the document root and beyond/below looking for "phpmailer_init" hook, and grab the variable. BTW the site along withwp-config.phpis hardened through Sucuri firewall and plugin system
– Riccardo
Jun 22 at 15:32
add a comment |
If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.
Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.
Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.
answered Jun 21 at 16:56
NicolaiNicolai
15.6k7 gold badges38 silver badges89 bronze badges
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "110"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fwordpress.stackexchange.com%2fquestions%2f341129%2fsafe-to-store-smtp-password-in-wp-config-php%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.
If your setup looks like: (And your public website lives inside of public_html)
/home/user/public_html/
__ wp-config.php
I would store a file in: (Which is not public facing at all)
/home/user/smtp-connect.php
And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.
The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/
answered Jun 21 at 17:08
ChristopherJonesChristopherJones
5438 bronze badges
2
Chapeau. We do this also already for years (storing thewp-config.phpfile in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty'wp-config.phpwhich has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials fromwp-config.phpin the regular spot will be exposed.
– Charles
Jun 21 at 18:38
This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.
– Nicolai
Jun 21 at 18:48
What if a malicious plugin accesses wp-config.php?
– Riccardo
Jun 21 at 18:55
I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.
– ChristopherJones
Jun 21 at 20:25
So to first step it might be storing the value in a non significative variable name, but any malicious plugin could scan all code in within the document root and beyond/below looking for "phpmailer_init" hook, and grab the variable. BTW the site along withwp-config.phpis hardened through Sucuri firewall and plugin system
– Riccardo
Jun 22 at 15:32
add a comment |
I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.
If your setup looks like: (And your public website lives inside of public_html)
/home/user/public_html/
__ wp-config.php
I would store a file in: (Which is not public facing at all)
/home/user/smtp-connect.php
And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.
The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/
answered Jun 21 at 17:08
ChristopherJonesChristopherJones
5438 bronze badges
2
Chapeau. We do this also already for years (storing thewp-config.phpfile in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty'wp-config.phpwhich has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials fromwp-config.phpin the regular spot will be exposed.
– Charles
Jun 21 at 18:38
This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.
– Nicolai
Jun 21 at 18:48
What if a malicious plugin accesses wp-config.php?
– Riccardo
Jun 21 at 18:55
I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.
– ChristopherJones
Jun 21 at 20:25
So to first step it might be storing the value in a non significative variable name, but any malicious plugin could scan all code in within the document root and beyond/below looking for "phpmailer_init" hook, and grab the variable. BTW the site along withwp-config.phpis hardened through Sucuri firewall and plugin system
– Riccardo
Jun 22 at 15:32
add a comment |
I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.
If your setup looks like: (And your public website lives inside of public_html)
/home/user/public_html/
__ wp-config.php
I would store a file in: (Which is not public facing at all)
/home/user/smtp-connect.php
And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.
The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/
answered Jun 21 at 17:08
ChristopherJonesChristopherJones
5438 bronze badges
I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.
If your setup looks like: (And your public website lives inside of public_html)
/home/user/public_html/
__ wp-config.php
I would store a file in: (Which is not public facing at all)
/home/user/smtp-connect.php
And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.
The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/
answered Jun 21 at 17:08
ChristopherJonesChristopherJones
5438 bronze badges
edited Jun 21 at 17:20
answered Jun 21 at 17:08
ChristopherJonesChristopherJones
5438 bronze badges
answered Jun 21 at 17:08
ChristopherJonesChristopherJones
5438 bronze badges
answered Jun 21 at 17:08
ChristopherJonesChristopherJones
5438 bronze badges
5438 bronze badges
2
Chapeau. We do this also already for years (storing thewp-config.phpfile in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty'wp-config.phpwhich has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials fromwp-config.phpin the regular spot will be exposed.
– Charles
Jun 21 at 18:38
This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.
– Nicolai
Jun 21 at 18:48
What if a malicious plugin accesses wp-config.php?
– Riccardo
Jun 21 at 18:55
I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.
– ChristopherJones
Jun 21 at 20:25
So to first step it might be storing the value in a non significative variable name, but any malicious plugin could scan all code in within the document root and beyond/below looking for "phpmailer_init" hook, and grab the variable. BTW the site along withwp-config.phpis hardened through Sucuri firewall and plugin system
– Riccardo
Jun 22 at 15:32
add a comment |
2
Chapeau. We do this also already for years (storing thewp-config.phpfile in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty'wp-config.phpwhich has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials fromwp-config.phpin the regular spot will be exposed.
– Charles
Jun 21 at 18:38
This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.
– Nicolai
Jun 21 at 18:48
What if a malicious plugin accesses wp-config.php?
– Riccardo
Jun 21 at 18:55
I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.
– ChristopherJones
Jun 21 at 20:25
So to first step it might be storing the value in a non significative variable name, but any malicious plugin could scan all code in within the document root and beyond/below looking for "phpmailer_init" hook, and grab the variable. BTW the site along withwp-config.phpis hardened through Sucuri firewall and plugin system
– Riccardo
Jun 22 at 15:32
2
2
Chapeau. We do this also already for years (storing the
wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.– Charles
Jun 21 at 18:38
Chapeau. We do this also already for years (storing the
wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.– Charles
Jun 21 at 18:38
This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.
– Nicolai
Jun 21 at 18:48
This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.
– Nicolai
Jun 21 at 18:48
What if a malicious plugin accesses wp-config.php?
– Riccardo
Jun 21 at 18:55
What if a malicious plugin accesses wp-config.php?
– Riccardo
Jun 21 at 18:55
I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.
– ChristopherJones
Jun 21 at 20:25
I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.
– ChristopherJones
Jun 21 at 20:25
So to first step it might be storing the value in a non significative variable name, but any malicious plugin could scan all code in within the document root and beyond/below looking for "phpmailer_init" hook, and grab the variable. BTW the site along with
wp-config.php is hardened through Sucuri firewall and plugin system– Riccardo
Jun 22 at 15:32
So to first step it might be storing the value in a non significative variable name, but any malicious plugin could scan all code in within the document root and beyond/below looking for "phpmailer_init" hook, and grab the variable. BTW the site along with
wp-config.php is hardened through Sucuri firewall and plugin system– Riccardo
Jun 22 at 15:32
add a comment |
If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.
Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.
Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.
answered Jun 21 at 16:56
NicolaiNicolai
15.6k7 gold badges38 silver badges89 bronze badges
add a comment |
If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.
Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.
Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.
answered Jun 21 at 16:56
NicolaiNicolai
15.6k7 gold badges38 silver badges89 bronze badges
add a comment |
If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.
Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.
Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.
answered Jun 21 at 16:56
NicolaiNicolai
15.6k7 gold badges38 silver badges89 bronze badges
If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.
Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.
Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.
answered Jun 21 at 16:56
NicolaiNicolai
15.6k7 gold badges38 silver badges89 bronze badges
answered Jun 21 at 16:56
NicolaiNicolai
15.6k7 gold badges38 silver badges89 bronze badges
answered Jun 21 at 16:56
NicolaiNicolai
15.6k7 gold badges38 silver badges89 bronze badges
answered Jun 21 at 16:56
NicolaiNicolai
15.6k7 gold badges38 silver badges89 bronze badges
15.6k7 gold badges38 silver badges89 bronze badges
add a comment |
add a comment |
Thanks for contributing an answer to WordPress Development Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fwordpress.stackexchange.com%2fquestions%2f341129%2fsafe-to-store-smtp-password-in-wp-config-php%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
