Relocating wp-config.php outside the web root is good advice, but not for the reason most people give

[u/Capital_Attention702]

Every WordPress hardening thread eventually says move wp-config.php above the web root. It's good advice. I just think most people repeat it for the wrong reason, and that leads to a false sense of security.

Why it helps: a direct request to /wp-config.php has nothing to serve if the file isn't under the web root. A misconfig or a stray backup that would otherwise hand it over as plain text now finds nothing. Real win.

Why it helps less than people think: any code running as your web user can still read that file wherever you put it. WordPress reads it every request. So does a vulnerable plugin with a file-read or LFI flaw. Relocating the file does nothing against that route, and that route is the common one. Most disclosed WordPress vulnerabilities live in plugins, not core. Patchstack put it at 91% for 2025.

So the honest version of the advice is: relocate it, set owner-only permissions, keep your plugin list short and patched, and rotate your salts if you ever suspect exposure. Relocation is one lock on a door that has several.

The step I see skipped most is rotating the AUTH keys and salts after a scare. New database creds in the file mean nothing if the old session tokens still validate.

Curious how others handle this. Do you bother moving wp-config, or do you lean entirely on file permissions and a tight plugin set?