---
title: "Simplest way to move your wp-config.php file to another location in WordPress for security"
date: 2012-02-21
author: "Tushar Thakur"
featured_image: "https://xtendedview.com/wp-content/uploads/2026/11/simplest-way-move-your-wp-config-php-file-another-location-wordpress-security.jpg"
categories:
  - name: "Internet"
    url: "/category/internet.md"
---

# Simplest way to move your wp-config.php file to another location in WordPress for security

The wp-config.php file holds the most sensitive settings of a self-hosted WordPress site: the database name, username and password, the database host, and the authentication keys and salts that protect logins. WordPress creates it during installation and places it in the main WordPress folder, which on most shared hosts is `public_html`.

Moving that file out of the public web folder is one of the simplest hardening steps you can take. This guide explains why it helps, the easiest way to do it, and a second method for setups where the easy way does not apply.

## Why move wp-config.php at all?

When PHP works normally, a visitor who opens `yourdomain.com/wp-config.php` sees a blank page, because the server runs the file instead of displaying it. The risk appears when something goes wrong:

- A server misconfiguration or a PHP update stops `.php` files from being processed, so the raw file is sent to the browser.
- A copy such as `wp-config.php.bak`, `wp-config.old` or an editor backup is left in the folder. Those files are not run as PHP and can be downloaded as plain text.

That password is the key to everything. With it, someone can connect to your database and add their own administrator account, delete or rewrite posts, insert spam links, or redirect every page of your site somewhere else.

A file that sits outside the web root cannot be requested over the web at all, so these mistakes no longer expose your database password. Moving it helps reduce risk; it does not protect you if an attacker already has access to your files through a vulnerable plugin or a stolen hosting login, so keep WordPress, plugins and themes updated as well.

## Before You Start

- Take a full backup of your site files and database.
- Have access to your hosting file manager (cPanel, hPanel or similar) or to the server over SFTP.
- Note where WordPress is installed. The steps below assume it sits directly in `public_html`.

## Method 1: Move wp-config.php One Level Up (Simplest)

WordPress already supports this without any code changes. When it starts, it looks for `wp-config.php` in its own folder first. If the file is not there, it checks the folder one level above, as long as that parent folder does not contain its own WordPress installation (WordPress checks for a `wp-settings.php` file there).

1. Open your file manager and go to `public_html`.
2. Move `wp-config.php` to the folder above it, usually your home directory, for example `/home/yourusername/`.
3. Load your site and log in to the dashboard to confirm everything works.

![cPanel File Manager Move dialog with wp-config.php selected in public_html and / entered as the destination](https://xtendedview.com/wp-content/uploads/2012/02/move-wp-config-one-level-up.webp)In File Manager, select wp-config.php in public\_html, click Move, enter / to send it to your home folder, then click Move File(s).That is the whole change. The file now lives outside the public folder, and WordPress still finds it on its own.

When this does not help: if WordPress is installed in a subfolder such as `public_html/blog`, the folder one level up is `public_html`, which is still public. Use Method 2 in that case.

## Method 2: Keep a Small Loader File and Store the Real File in a Private Folder

This method lets you put the real configuration file in any private folder you choose.

1. In your home directory (outside `public_html`), create a new folder, for example `wp-private`.
2. Move your original `wp-config.php` into that folder.

![cPanel File Manager showing wp-config.php inside a wp-private folder in the home directory](https://xtendedview.com/wp-content/uploads/2012/02/wp-config-in-private-folder.webp)Use + Folder to create a private folder such as wp-private in your home folder, outside public\_html, then move wp-config.php into it.3. In `public_html`, where the original file used to be, create a new file named `wp-config.php` with only this code:

```
<?php
define( 'ABSPATH', __DIR__ . '/' );
require_once '/home/yourusername/wp-private/wp-config.php';
```

Replace `yourusername` and `wp-private` with your real home folder and folder name. Your hosting control panel usually shows the full home path in the file manager.

The `ABSPATH` line matters. The standard `wp-config.php` sets `ABSPATH` to the folder the file sits in and then loads `wp-settings.php` from there. After the move, that folder is `wp-private`, which has no WordPress files, so the site would fail to load. Defining `ABSPATH` in the loader first points WordPress back to `public_html`.

4. Reload your site and log in to the dashboard to confirm it works.

## Extra Hardening for wp-config.php

- File permissions: the WordPress hardening guide suggests 440 or 400 for `wp-config.php`, so only the owner can read it. If your host runs PHP as a different user and the site stops loading, set it back to 640 or 644, the usual default for WordPress files. Editing a file in the file manager can sometimes reset its permissions, so check them again after any edit. ![cPanel Change Permissions dialog for wp-config.php with Read ticked for User and Group, giving 440](https://xtendedview.com/wp-content/uploads/2012/02/wp-config-permissions-440.webp)Select wp-config.php, click Permissions, tick Read for User and Group only so the value reads 440, then click Change Permissions.
- Block direct access on Apache or LiteSpeed: if the file stays in `public_html`, add this to the `.htaccess` file in that folder: ```
    <Files wp-config.php>
    Require all denied
    </Files>
    ```
    
    On an older Apache 2.2 server, use `Order allow,deny` and `Deny from all` inside the same block instead of `Require all denied`.
- Remove stray copies: delete any `wp-config.php.bak`, `.old`, `.save` or `~` files from the web folder.
- Use unique keys and salts: the eight `AUTH_KEY` to `NONCE_SALT` lines in the file sign your login cookies. Get a fresh set from the [official WordPress generator](https://api.wordpress.org/secret-key/1.1/salt/) and paste it over the old lines. Doing this logs everyone out, which is what you want if you think the file was ever exposed. Change the database password at the same time.

## Common Errors and Fixes

- The WordPress setup screen appears (“There doesn’t seem to be a wp-config.php file”): WordPress cannot find the file. With Method 1, make sure the file is exactly one level above the WordPress folder. With Method 2, make sure the loader file is in `public_html`.
- “Failed opening required” or a fatal error naming your private folder: the path in the loader file is wrong. Check the home folder name, the folder name and the spelling of `wp-config.php`.
- A fatal error about wp-settings.php: the `ABSPATH` line is missing from the loader file, or it comes after the `require_once` line.
- A plugin cannot save a setting to wp-config.php: some plugins edit the file automatically and may expect it in the WordPress folder. Add the setting they need to the real file by hand.

If you are stuck, restore the original file to `public_html` from your backup and the site will work as before.