You can move wp-config.php one directory above your WordPress install, and WordPress will still find it. It can help keep the file out of the public web folder. But the official guidance calls the practice debated and warns it can introduce serious vulnerabilities if done carelessly. Get permissions and server settings right first.
Why people do it
wp-config.php holds database credentials and secret keys. If a server misconfiguration ever served PHP files as plain text, a file inside the web root could leak. Placing it above the web root means the web server has no URL path to it.
The WordPress hardening guide says you can move the file to the directory above the install, and that you should restrict read access so only you and the web server can read it.
Why the guidance is cautious
The same guide states that the move is debated and, if not done carefully, may actually introduce serious vulnerabilities. It does not spell out the cases, so apply general reasoning: a moved file may end up in a directory with looser permissions, in a folder shared with other sites, or in a backup that is world readable.
| Situation | Moving helps? |
|---|---|
| Dedicated account, tight permissions | Possibly a small gain |
| Shared directory above the web root used by other sites | May expose the file to them |
| Server already blocks direct access and serves PHP correctly | Small gain |
| Poor file permissions on the file | Fix permissions first, moving will not help |
What matters more
- File permissions. The documentation sets files to 644 and directories to 755 as a baseline, and wants files writable only by your account. Review the config file specifically, and consider a stricter setting if your host allows it.
- Who can log in to the server and read the file.
- Whether backups containing the file are protected.
- Whether the database user has only the privileges it needs.
- Whether secrets are rotated if the file was ever exposed.
How to move it safely
- Back up the site.
- Confirm the directory above the web root is not shared and not served.
- Move the file there and test the site.
- Set owner and permissions so that only the account and the web server can read it.
- Remove the old copy and confirm the URL returns nothing.
- Record the change in your handover notes.
A note on keys
If you suspect the file was ever readable by others, changing the database password and the secret keys is a better response than relocating the file. Relocation hides, rotation fixes.
Move the file only if you understand your server layout, and document it so the next person is not surprised. Safeguard can scan a repository for dependency manifests and produce an SBOM, and there is a free scan at gold.safeguard.sh/scan.
Quick check
Will WordPress find wp-config.php if I move it up one level?
Yes, WordPress looks in the directory above the install. Test the site after the move.
Is moving it enough to protect my credentials?
No. Permissions, account access and backups matter more. Rotate credentials if the file may have been exposed.
Sources
Last reviewed: 19 October 2026.
