Disclosure: I am a developer and not a security expert
I am working on a Wordpress site for a client who is (understandably) concerned about WP security. The client will be hosting the site on their own infrastructure and their IT department that manages their servers is asking me to configure SFTP. This was raised when I gave the webserver (www-data) ownership over the WP site files.
One of the things that made me even question the benefit of SFTP was realising that you store the SFTP credentials and key details in the WP-config.php file.
The concern here, in my opinion, was that if there was a vulnerability that was exploited and the hacker managed to compromise the WP installation, they can obtain these SFTP credentials with a single line of code (
file_get_contents (ABSPATH . "wp-config.php");)
So my questions is: If the server itself has no external FTP access due to their firewalls, what is the benefit of SFTP over FTP? I've read numerous nightmare issues with debugging SFTP errors with Wordpress so I'm reluctant to do so.