Your Website Files may be Secured, but What About the Database?

One of the items on our ‘New Customer Audit’ process is to verify that the WordPress database (uusally MySQL) is secured as well as the files.

In the root of your website is a file named wp-config.php.  Among other things, this file contains the name of the database, the username, and the password.  When the file’s permissions are properly configured, this file is not accessible to the public (That’s another item we check in our audit.) If a hacker can get his hands on these database credentials, there is a decent chance that he can access your WordPress database.  And if he can do that he effectively can do anything.

Fortunately, MySQL allows you to configure database usernames so that they work only from the server itself.  Unfortunately, we see this setting misconfigured more times than not. When the database user is created, you can specify one of three values:

• ‘localhost’ which means the connection to the database must come from the same server where the database lives.
• % which means that the connection can come from anywhere.
• ‘hostname’ which means the specific name or IP address. You’ll see this when a web hosting company uses separate servers for its web servers and database servers.

Too many times during our audits we find that ‘%’ has been specified instead of ‘localhost’.

If you are creating your own WordPress installation don’t make this mistake.