WordPress sites are often broken into through their configuration, not their code: salts that still say 'put your unique phrase here', a wp-config.php.bak that the web server hands out as plain text, or a debug.log anyone can download. This skill finds those and seven other wp-config mistakes before a site goes live or is handed over, and tells you how to fix each one.

Your agent runs a scanner on your site folder. It reads wp-config.php, wp-config-<name>.php files, Bedrock's config/application.php and environment files, and backup copies of wp-config.php. It understands PHP comments and strings, so a commented-out define does not count and salts full of symbols are read correctly. It never runs PHP or WordPress. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Salts and passwords are never printed.

What it checks

BLOCK (fix before shipping)

• V01: keys and salts that still say 'put your unique phrase here'

• V02: WP_DEBUG on without WP_DEBUG_DISPLAY turned off, so errors show on pages

• V03: WP_DEBUG_LOG writing to wp-content/debug.log or elsewhere under the web root

• V04: a copy of wp-config.php that does not end in .php (.bak, .old, .orig, .save, .swp, .txt, ~ and similar)

REVIEW (check before release)

• V11: DISALLOW_FILE_EDIT not set, so admins can edit theme and plugin PHP in the dashboard

• V12: FORCE_SSL_ADMIN set to false

• V13: automatic updates turned off (AUTOMATIC_UPDATER_DISABLED or WP_AUTO_UPDATE_CORE false)

• V14: DB_USER is root

• V15: an empty DB_PASSWORD

• V16: keys or salts shorter than 32 characters, or repeated

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example wp-config.php, a backup copy to find, and the real report the scanner produces on the risky example

Limits

It reads define() calls as written, so constants set in included files, values from the database and server rules that block files are not seen. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 8 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (3 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.