Removing wp-config-sample.php file from the root of the WordPress application can be considered as a good security practice or it does not make any difference for security?


Removing the wp-config-sample.php doesn't make any difference: it doesn't contain anything important, it doesn't run anything by itself and nothing in WordPress use any configuration parameters from it.

What's more important is to avoid having any copies of the actual wp-config.php with a different file extension that wouldn't get treated as a PHP script, revealing the contents including database password. E.g. some editors could leave such backups.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.