wp-config.php is readable over the web

What Wordfence found

wp-config.php returned content rather than being executed or blocked. This usually means PHP is not handling the file — a misconfigured server, a rename that removed the .php extension, or a copy left with a different suffix.

Why it matters

wp-config.php contains the database name, user, password and the authentication salts. Anyone who reads it can usually connect to the database directly and can forge session cookies. There is no more serious disclosure on a WordPress site.

How to fix it

1. 1Treat this as an active incident, not a hygiene item.
2. 2Block access immediately at the web server.
3. 3Change the database password, then update wp-config.php with the new one.
4. 4Regenerate every salt in wp-config.php, which logs everyone out and invalidates forged cookies.
5. 5Review database access logs if the host provides them.
6. 6Then find the misconfiguration that exposed it, because it may expose other files too.

Findings that often appear with this one

• A config, backup or log file is publicly accessible Public files
• A database backup is publicly accessible Public files
• An administrator was created outside WordPress Login

How WPSecureOps treats it

The connector reports this as configReadable. WPSecureOps files it under Public files and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.