wp-config.php outside the document root

You can keep wp-config.php above the document root so it is not reachable as a public URL. WordPress searches the current folder and then each parent until it finds that file, so a path such as /home/username/wp-config.php still works when the site lives in public_html. On shared hosting this is optional hardening. It also cleans up accounts that have leftover copies of the same file.

That file holds production secrets: the database password, authentication salts, and sometimes mail settings. Treat its path carefully. Multiple wp-config.php files are the usual failure mode, because PHP may load the wrong one while you edit a copy that never runs.

How WordPress finds the file

A request reaches public_html/index.php, or index.php inside a subdirectory install. WordPress checks the current directory, then the parent, then the next parent, until it finds wp-config.php or reaches the account home. The common layout puts the file in /home/username/wp-config.php and the application in /home/username/public_html/. PHP still reads it. Apache or LiteSpeed will not serve it at https://example.com/wp-config.php because it sits outside the document root.

Find every copy before you move anything

List every wp-config.php in the account first. Check public_html, old site folders, staging areas, and backup archives you extracted for a quick look. Keep one live file. That file should belong to the app whose parent directory will hold it after the move. After you relocate it, load the site to confirm it still works. Then request the old /wp-config.php URL and confirm you get a 404, not a 200.

Addon domains and leftover paths

On an addon domain the document root is often public_html/addon.example.com/. Walking upward from there can still find a wp-config.php in public_html that belongs to the primary site. Place the addon’s config in a parent only that app will walk, or keep it inside the addon document root with tight permissions and no duplicates. The upward search is supported behavior. It is also how the wrong file can win.

Moving wp-config.php does not replace 640-style permissions, a unique database user, or keeping backups out of the document root. It blocks one leak class where a mis-set document root would have exposed the config as a URL. It is unrelated to SSH port changes, so keep those topics on separate tickets.