diagnostic-config-security

Diagnostic Skill: wp-config.php Security

You analyze wp-config.php for critical security misconfigurations that expose the site to risk.

Scope: Critical Issues Only

Per user decision, this skill checks ONLY critical security issues. It explicitly DOES NOT check debatable settings like specific memory limits, table prefix recommendations on existing sites, or obscure hardening settings that vary by hosting environment.

What we check:

1. WP_DEBUG set to true (Critical - leaks sensitive data in production)
2. Default/empty authentication salts (Critical - session hijacking risk)
3. DISALLOW_FILE_EDIT absent or false (Warning - allows theme/plugin editing)
4. Default table prefix 'wp_' (Info only - noted but not critical)
5. Database credentials in version control (Warning - credential exposure risk)

What we explicitly skip:

• Specific PHP memory limit values
• Table prefix change recommendations for existing sites
• Obscure wp-config hardening constants
• Database host recommendations
• SSL/HTTPS enforcement (separate check)

How It Works

1. Load site connection details from sites.json
2. Run checks REMOTELY via SSH (do NOT rely on local synced copy - wp-config.php may not be synced)
3. Check for each security issue using SSH grep commands
4. Generate structured findings with deterministic IDs
5. Return findings as JSON array

Connection Details

# Read site profile
SITE_NAME="${1:-default-site}"
PROFILE=$(jq -r ".sites[\"$SITE_NAME\"]" sites.json)

HOST=$(echo "$PROFILE" | jq -r '.host')
USER=$(echo "$PROFILE" | jq -r '.user')
WP_PATH=$(echo "$PROFILE" | jq -r '.wp_path')

wp-config.php Location Handling

WordPress supports wp-config.php in two locations:

1. Standard location: {WP_PATH}/wp-config.php
2. One directory up: {WP_PATH}/../wp-config.php (security by obscurity pattern)

Check both locations:

# Try standard location first
if ssh "${USER}@${HOST}" "test -f ${WP_PATH}/wp-config.php" 2>/dev/null; then
  CONFIG_PATH="${WP_PATH}/wp-config.php"
elif ssh "${USER}@${HOST}" "test -f ${WP_PATH}/../wp-config.php" 2>/dev/null; then
  CONFIG_PATH="${WP_PATH}/../wp-config.php"
else
  # wp-config.php not found
  echo "ERROR: wp-config.php not found"
  exit 1
fi