2. Hardening the wp-config.php File
The `wp-config.php` file is the most critical file in your entire installation. It contains your plaintext database passwords and root configuration keys. We must lock it down immediately.
Recommended workflow
- Generate Unique Security Salts: Never use default salts. Navigate to the official WordPress Salt Generator API, copy the generated keys, and replace the dummy keys in your wp-config.php file. This ensures active user sessions are cryptographically secure.
- Disable File Editing: Prevent attackers from editing your theme or plugin files from within the wp-admin dashboard. Add `define( 'DISALLOW_FILE_EDIT', true );` to your config file.
- Limit Post Revisions: WordPress saves a new copy of your post every time you hit draft. Over years, this bloats the database with thousands of useless rows, destroying query performance. Add `define( 'WP_POST_REVISIONS', 5 );` to limit it.
- Disable WP-Cron (For High Traffic Sites): The default WordPress cron job fires on every single page load, destroying CPU performance on high-traffic sites. Add `define( 'DISABLE_WP_CRON', true );` and instead, create a real server-level cron job in your KairoHost LLC panel to trigger `wp-cron.php` exactly once every 15 minutes.
- Protect the File: Set the file permissions of `wp-config.php` to `440` or `400` so that only the system owner can read it, preventing directory traversal attacks from reading your database passwords.
Notes and best practices
- Always backup your wp-config.php file locally before making manual code edits.
- Debug Mode: Never leave `WP_DEBUG` set to `true` on a live production site. It will print sensitive server paths and database query errors directly to the public browser, providing a roadmap for hackers.
