wp-config.php.old: Understanding WordPress Backup Files and Security Risks

• Key Takeaway 1: wp-config.php.old is a backup file created by WordPress core updates or manual modifications. It contains sensitive database credentials and secrets.
• Key Takeaway 2: Leaving this file in your web root exposes your database password to public access, creating a critical security vulnerability for attackers.
• Key Takeaway 3: You should immediately delete wp-config.php.old after verifying that the active wp-config.php file is functioning correctly.
• Key Takeaway 4: This file does not impact your live site if the primary configuration file is intact; it is only relevant for restoration in case of a failed update.

What Is wp-config.php.old and Why Does It Exist?

When you update WordPress core, plugins, or manually edit your wp-config.php file, the system often creates a backup copy named wp-config.php.old. This mechanism is designed to allow you to roll back changes if the new configuration causes fatal errors. However, many users discover these files long after the update and are unsure whether they can be safely removed.

The primary pain point here is security exposure. The wp-config.php file contains your database host, username, password, table prefix, and authentication salts. If wp-config.php.old remains accessible via the web, an attacker can download it and gain direct access to your database. This is why immediate deletion is the standard best practice once you have confirmed your site is running stably.

How to Safely Remove wp-config.php.old

Before deleting the backup file, follow this checklist to ensure you do not break your WordPress installation:

• ✅ Verify Site Functionality: Load your homepage and an admin page (without logging in) to ensure no critical errors appear.
• ✅ Test Admin Login: Confirm that you can log in to /wp-admin successfully.
• ✅ Check File Permissions: Ensure your active wp-config.php has the correct permissions (typically 644).
• ✅ Backup Current Config: For your own peace of mind, manually download a copy of the active wp-config.php to your local machine before deleting the .old file.
• ✅ Delete the .old File: Use your hosting file manager or FTP client to permanently delete wp-config.php.old.

Comparing Risk Levels: Keeping vs. Deleting the Backup File

Factor	Keeping wp-config.php.old	Deleting wp-config.php.old
Security Risk	🔴 High – Exposes DB credentials publicly	🟢 Low – No sensitive data exposed
Recovery Ease	🟢 Immediate rollback available	🟡 Requires manual restoration from manual backup
Best For	Active troubleshooting only	All stable, production environments

FAQ: Common Questions About wp-config.php.old

Q1: Will deleting wp-config.php.old break my website?

No. Deleting the backup file will not affect your live site as long as your primary wp-config.php is intact and correctly configured. The .old file serves no active role in WordPress operations; it is purely a safety net. Once you have confirmed stability, it is safe to remove.

Q2: I found multiple wp-config.php.old files. Should I delete all of them?

Yes. WordPress may create new .old files with each update or modification. Any file older than 24–48 hours with no active troubleshooting is a security risk. Delete all outdated backup configuration files to minimize your attack surface.

Q3: Can I hide wp-config.php.old instead of deleting it?

You can attempt to hide it by adding a rule to your .htaccess file to deny access, but this is not recommended. The safest and most reliable approach is deletion. Obfuscation or hiding can fail silently, leaving your credentials exposed. Delete the file and keep a manual backup on your local machine if you need a fallback.