[TheLastSuperman]

Originally Posted by Adrian Schneider

Sorry if I'm missing something, but how does this stop hackers?

1. Hackers do not try to view config.php directly from the browser
2. Hackers usually end up hacking plugins / templates / template cache, which means it runs in PHP, which means they could easily find and have access to your config.php no matter where it is (as long as vBulletin can read it, so can they)
3. Hackers often get in from other web applications / vulnerabilities on your server.
4. Your credentials are stored in plaintext in memory with vBulletin, so a simple var_dump will show them.

This sort of thing is a little security by obscurity at best, but is by no means where you should be focusing your attention.

Not trying to be negative, but I also don't want people thinking that moving their config.php is going to protect them from hackers. At best it'll just cause some minor problems when they go upgrade.

Stopped a professional at CrowdGather from moving one of my clients forums after they purchased (lol), so perhaps we should say hide instead of protect and "script kiddies" instead of hackers as many of them don't even know how to do all the above Adrian but valid points you have there.