diagnostic-config-security

You can audit wp-config.php security by running a remote SSH scan that checks for WP_DEBUG enabled, default salts, missing DISALLOW_FILE_EDIT, and database credentials in version control. Findings are returned as structured JSON with severity levels and fix instructions.

Critical security risks in wp-config.php include enabled WP_DEBUG, default authentication salts, missing DISALLOW_FILE_EDIT constants, and exposed database credentials. A remote SSH scan identifies these vulnerabilities and returns actionable fix instructions.

Yes, the security scan connects remotely via SSH and checks both standard and adjacent file locations for wp-config.php. This ensures misconfigurations are detected even when the WordPress configuration file is moved from its default path.

No WordPress plugins are required, but you do need remote SSH access to the server. The scan directly analyzes the wp-config.php file over SSH to identify critical security misconfigurations without installing additional software on the site.

Security vulnerabilities are prioritized by severity levels: Critical, Warning, and Info. The scan outputs a structured JSON array with deterministic IDs for each finding, ensuring you can systematically track and resolve exposed database credentials and other risks.