Safe to store SMTP password in wp-config.php?Password in wp-config. Dangerous?2 accounts under same email preventing me from loging inWordpress SMTP EMailhow wordpress smtp works? my emailing is not workingwp-config.php being deletedSMTP Issues with Outlook 365SMTP connect() failedConfused over wp-config.php and 'database user + database password + name'Easy WP SMTP plugin test email failedHow can I configure an SMTP Server?can't submit mail from contact 7 form site using wp mail smtp

How do I make a very short story impactful?

How well known and how commonly used was Huffman coding in 1979?

What is the legal status of travelling with (unprescribed) methadone in your carry-on?

Safe to store SMTP password in wp-config.php?

Smooth Julia set for quadratic polynomials

Change CPU MHz from Registry

Can’t attend PhD conferences

Hot coffee brewing solutions for deep woods camping

Low-gravity Bronze Age fortifications

Is adding a new player (or players) a DM decision, or a group decision?

What happens when I sacrifice a creature when my Teysa Karlov is on the battlefield?

Did Karl Marx ever use any example that involved cotton and dollars to illustrate the way capital and surplus value were generated?

Should my manager be aware of private LinkedIn approaches I receive? How to politely have this happen?

Is there a maximum distance from a planet that a moon can orbit?

Unusual mail headers, evidence of an attempted attack. Have I been pwned?

Animation advice please

Can White Castle?

Why is C++ initial allocation so much larger than C's?

Changing the opacity of lines on a plot based on their value

STM Microcontroller burns every time

Does squid ink pasta bleed?

A player is constantly pestering me about rules, what do I do as a DM?

Impossible darts scores

Do hotel cleaning personnel have any benefit from leaving empty bottles in the room as opposed to returning them to the store?



Safe to store SMTP password in wp-config.php?


Password in wp-config. Dangerous?2 accounts under same email preventing me from loging inWordpress SMTP EMailhow wordpress smtp works? my emailing is not workingwp-config.php being deletedSMTP Issues with Outlook 365SMTP connect() failedConfused over wp-config.php and 'database user + database password + name'Easy WP SMTP plugin test email failedHow can I configure an SMTP Server?can't submit mail from contact 7 form site using wp mail smtp






.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;








1















I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php?
Very similar to this.
Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.










share|improve this question






























    1















    I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php?
    Very similar to this.
    Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.










    share|improve this question


























      1












      1








      1








      I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php?
      Very similar to this.
      Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.










      share|improve this question
















      I am using SMTP to send email through WordPress, however this requires using plain text password. What if this password is stored in wp-config.php?
      Very similar to this.
      Why this topic differs from the linked one: the nature of the password. This password can be used for spam mass mailing, and may require additional protection steps and considerations.







      password wp-config smtp






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited 7 hours ago









      Nicolai

      15.6k7 gold badges38 silver badges89 bronze badges




      15.6k7 gold badges38 silver badges89 bronze badges










      asked 9 hours ago









      RiccardoRiccardo

      4478 silver badges26 bronze badges




      4478 silver badges26 bronze badges




















          2 Answers
          2






          active

          oldest

          votes


















          2














          I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.



          If your setup looks like: (And your public website lives inside of public_html)



          /home/user/public_html/
          __ wp-config.php


          I would store a file in: (Which is not public facing at all)



          /home/user/smtp-connect.php


          And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.



          The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
          https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/






          share|improve this answer




















          • 2





            Chapeau. We do this also already for years (storing the wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.

            – Charles
            6 hours ago











          • This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.

            – Nicolai
            6 hours ago












          • What if a malicious plugin accesses wp-config.php?

            – Riccardo
            6 hours ago












          • I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.

            – ChristopherJones
            4 hours ago


















          1














          If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.



          Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.



          Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.






          share|improve this answer

























            Your Answer








            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "110"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader:
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            ,
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













            draft saved

            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fwordpress.stackexchange.com%2fquestions%2f341129%2fsafe-to-store-smtp-password-in-wp-config-php%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            2














            I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.



            If your setup looks like: (And your public website lives inside of public_html)



            /home/user/public_html/
            __ wp-config.php


            I would store a file in: (Which is not public facing at all)



            /home/user/smtp-connect.php


            And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.



            The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
            https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/






            share|improve this answer




















            • 2





              Chapeau. We do this also already for years (storing the wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.

              – Charles
              6 hours ago











            • This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.

              – Nicolai
              6 hours ago












            • What if a malicious plugin accesses wp-config.php?

              – Riccardo
              6 hours ago












            • I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.

              – ChristopherJones
              4 hours ago















            2














            I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.



            If your setup looks like: (And your public website lives inside of public_html)



            /home/user/public_html/
            __ wp-config.php


            I would store a file in: (Which is not public facing at all)



            /home/user/smtp-connect.php


            And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.



            The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
            https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/






            share|improve this answer




















            • 2





              Chapeau. We do this also already for years (storing the wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.

              – Charles
              6 hours ago











            • This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.

              – Nicolai
              6 hours ago












            • What if a malicious plugin accesses wp-config.php?

              – Riccardo
              6 hours ago












            • I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.

              – ChristopherJones
              4 hours ago













            2












            2








            2







            I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.



            If your setup looks like: (And your public website lives inside of public_html)



            /home/user/public_html/
            __ wp-config.php


            I would store a file in: (Which is not public facing at all)



            /home/user/smtp-connect.php


            And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.



            The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
            https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/






            share|improve this answer















            I am not sure where you else you would store the SMTP credentials? I am not comfortable storing those credentials in the Database because of the trouble you mentioned you could get into if they got out. Or putting them in a theme file. Like they mentioned in the other thread, if Apache gets screwed up and that files gets processed as plain text. Your credentials get exposed. If your DB is setup to only accept localhost connections or a specific IP, that could save you. But if your SMTP credentials get out, you might not have those luxuries.



            If your setup looks like: (And your public website lives inside of public_html)



            /home/user/public_html/
            __ wp-config.php


            I would store a file in: (Which is not public facing at all)



            /home/user/smtp-connect.php


            And then include() or require_once() that smtp-connect.php file when you need it. Have your credentials stored in there and your connection script in there as well.



            The article you referenced has some good points about locking up your wp-config file. Here is another article that I think could shed some more light on the security of wp-config.php and some work arounds to help secure it if you decide to setup some PHP Constants for your SMTP Credentials:
            https://www.wpwhitesecurity.com/protect-wordpress-wp-config-php-security/







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited 7 hours ago

























            answered 7 hours ago









            ChristopherJonesChristopherJones

            4007 bronze badges




            4007 bronze badges







            • 2





              Chapeau. We do this also already for years (storing the wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.

              – Charles
              6 hours ago











            • This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.

              – Nicolai
              6 hours ago












            • What if a malicious plugin accesses wp-config.php?

              – Riccardo
              6 hours ago












            • I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.

              – ChristopherJones
              4 hours ago












            • 2





              Chapeau. We do this also already for years (storing the wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.

              – Charles
              6 hours ago











            • This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.

              – Nicolai
              6 hours ago












            • What if a malicious plugin accesses wp-config.php?

              – Riccardo
              6 hours ago












            • I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.

              – ChristopherJones
              4 hours ago







            2




            2





            Chapeau. We do this also already for years (storing the wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.

            – Charles
            6 hours ago





            Chapeau. We do this also already for years (storing the wp-config.php file in a place which actually nothing has to do with the website at all) and it works like a charm. We use an 'empty' wp-config.php which has just the include line. Easy, safe and reliable. Have to admit that you must have the access to such but that is logical when you want to do it like this. Note, "if Apache gets screwed" then you have much more issues then just a possible exposing of such. Then is even your DB not safe anymore because the credentials from wp-config.php in the regular spot will be exposed.

            – Charles
            6 hours ago













            This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.

            – Nicolai
            6 hours ago






            This works great, and is a good step to harden and secure the setup, so +1. I disagree with the aversion to the database though, because if you deal with several or even a multitude of SMTP credentials, it just works better in those cases.

            – Nicolai
            6 hours ago














            What if a malicious plugin accesses wp-config.php?

            – Riccardo
            6 hours ago






            What if a malicious plugin accesses wp-config.php?

            – Riccardo
            6 hours ago














            I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.

            – ChristopherJones
            4 hours ago





            I am not the best person to talk on malicious plugins. We've used two plugins for most of what we do and we spend time quarterly vetting the updates that get pushed out to the plugins. With any plugin, one should spend some time looking at the code base before getting in bed with it. But any plugin would have access to wp-config.php and could most likely write to the file as well.

            – ChristopherJones
            4 hours ago













            1














            If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.



            Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.



            Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.






            share|improve this answer



























              1














              If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.



              Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.



              Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.






              share|improve this answer

























                1












                1








                1







                If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.



                Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.



                Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.






                share|improve this answer













                If you want to make it a bit safer, save the password into the database. Making additional steps necessary to access the SMTP data. You should store sensitive data encrypted, of course.



                Besides that, someone malignant having access to your wp-config.php, is pretty much the worst case scenario anyway. So it is of utmost importance to make sure to keep your security up-to-date. So apply all updates for security fixes, WordPress, PHP, simply any software on your server that could be used as attack vector. Furthermore, harden your WordPress and server setup, e.g. file access, access to database and so on.



                Generally speaking, to answer your question, if your server is secure, then it's safe to store the SMTP data into the wp-config.php.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered 7 hours ago









                NicolaiNicolai

                15.6k7 gold badges38 silver badges89 bronze badges




                15.6k7 gold badges38 silver badges89 bronze badges



























                    draft saved

                    draft discarded
















































                    Thanks for contributing an answer to WordPress Development Stack Exchange!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid


                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.

                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fwordpress.stackexchange.com%2fquestions%2f341129%2fsafe-to-store-smtp-password-in-wp-config-php%23new-answer', 'question_page');

                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Sahara Skak | Bilen | Luke uk diar | NawigatsjuunCommonskategorii: SaharaWikivoyage raisfeerer: Sahara26° N, 13° O

                    The fall designs the understood secretary. Looking glass Science Shock Discovery Hot Everybody Loves Raymond Smile 곳 서비스 성실하다 Defas Kaloolon Definition: To combine or impregnate with sulphur or any of its compounds as to sulphurize caoutchouc in vulcanizing Flame colored Reason Useful Thin Help 갖다 유명하다 낙엽 장례식 Country Iron Definition: A fencer a gladiator one who exhibits his skill in the use of the sword Definition: The American black throated bunting Spiza Americana Nostalgic Needy Method to my madness 시키다 평가되다 전부 소설가 우아하다 Argument Tin Feeling Representative Gym Music Gaur Chicken 일쑤 코치 편 학생증 The harbor values the sugar. Vasagle Yammoe Enstatite Definition: Capable of being limited Road Neighborly Five Refer Built Kangaroo 비비다 Degree Release Bargain Horse 하루 형님 유교 석 동부 괴롭히다 경제력

                    19. јануар Садржај Догађаји Рођења Смрти Празници и дани сећања Види још Референце Мени за навигацијуу