1
define('SECURE_AUTH_KEY', 
define('AUTH_KEY',        
define('LOGGED_IN_KEY',    
define('NONCE_KEY',        
define('AUTH_SALT',        
define('SECURE_AUTH_SALT', 
define('LOGGED_IN_SALT',   
define('NONCE_SALT',

This is what my wp-config.php file contains And I saw from access logs It was accessed about 20 times from other ips.

What to do? Can they compromise my wp data?

Improve this question
  • Was it shown to the clients connecting, or was it just parsed by php? Because you enter example.org/wp-config.php, you will not see the content if the host is running the php, as it doesn't produce any output. – vidarlo Jan 2 '19 at 14:00
  • Your title question does not match the body. The title question is a question for webmasters.stackexchange.com – schroeder♦ Jan 6 '19 at 16:16
  • By just getting the salts, they cannot compromise data, they would also need the hashes, of course. – schroeder♦ Jan 6 '19 at 16:17
  • ok @schroeder I think it has to do with security not webmasters – Born vs. Me Jan 6 '19 at 17:55
  • Which part of the question? "How to change the salts" is not a security question. – schroeder♦ Jan 6 '19 at 18:19
0

What to do? Can they compromise my wp data?

First and foremost, fix the vulnerability and/or how it leaked. Usually, an update should fix such vulnerabilities if they're from plugins/themes or WordPress core itself. If not, you can at least block requests to path that you saw on your access log, assuming it's 100% a leak.

Then, change your salts from
https://api.wordpress.org/secret-key/1.1/salt

And yes, change your database credentials and update everything accordingly.

They cannot compromise anything unless-

  • You have MySQL remote connection enabled or
  • You have a phpMyAdmin/Adminer exposed or
  • You're on a shared hosting or
  • You use the same password for your other accounts
Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.