How is this different from the config-backup finding?

This is the live file itself being served as text rather than executed — which means everyone who requests it sees your current database credentials and salts, not an old copy's. It is the more severe of the two and typically indicates PHP handling is broken or misconfigured at the server level.

What causes a server to serve PHP as text?

A broken PHP handler after a host migration or PHP version change, a misconfigured nginx block that matches the file before the PHP location does, or the file being renamed to something the handler does not match. It often affects more than one file — check whether other .php files also return source.

What do I do, in what order?

Block access immediately (a deny rule for wp-config.php at the web server takes seconds), fix the PHP handling, then rotate the database password and all eight salts — the file's contents must be assumed copied. Rotating salts logs every user out, which in this situation is a feature.

Glossary · Public files

wp-config.php is readable over the web

Wordfence type: configReadable
Category: Public files
Severity: Critical

The main WordPress configuration file can be fetched over HTTP, exposing database credentials.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

Your wp-config.php file is readable by the public.

What Wordfence found

wp-config.php returned content rather than being executed or blocked. This usually means PHP is not handling the file — a misconfigured server, a rename that removed the .php extension, or a copy left with a different suffix.

Why it matters

wp-config.php contains the database name, user, password and the authentication salts. Anyone who reads it can usually connect to the database directly and can forge session cookies. There is no more serious disclosure on a WordPress site.

How to fix it

1Treat this as an active incident, not a hygiene item.
2Block access immediately at the web server.
3Change the database password, then update wp-config.php with the new one.
4Regenerate every salt in wp-config.php, which logs everyone out and invalidates forged cookies.
5Review database access logs if the host provides them.
6Then find the misconfiguration that exposed it, because it may expose other files too.

Common questions

How is this different from the config-backup finding?: This is the live file itself being served as text rather than executed — which means everyone who requests it sees your current database credentials and salts, not an old copy's. It is the more severe of the two and typically indicates PHP handling is broken or misconfigured at the server level.
What causes a server to serve PHP as text?: A broken PHP handler after a host migration or PHP version change, a misconfigured nginx block that matches the file before the PHP location does, or the file being renamed to something the handler does not match. It often affects more than one file — check whether other .php files also return source.
What do I do, in what order?: Block access immediately (a deny rule for wp-config.php at the web server takes seconds), fix the PHP handling, then rotate the database password and all eight salts — the file's contents must be assumed copied. Rotating salts logs every user out, which in this situation is a feature.

Findings that often appear with this one

A config, backup or log file is publicly accessible Public files
A database backup is publicly accessible Public files
An administrator was created outside WordPress Login

How WPSecureOps treats it

The connector reports this as configReadable. WPSecureOps files it under Public files and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.