The default.settings.php file contains the following comment:

For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that this file is not stored with backups of your database.


$settings['hash_salt'] = file_get_contents('/home/example/salt.txt');

Assuming the attacker was able to create a PHP file inside my Drupal installation, in which way does writing the hash salt in a file increases the security? In any case, the attacker would be able to read the value for $settings['hash_salt']. Eventually, the attacker could change the value for $settings['hash_salt'], but does doing this make any sense for the attackers to do?

1 Answer 1


The main reason to do this is to prevent the salt from accidentally being committed to your content versioning system.

Most advanced hosting environments (both Drupal hosts and all-in-one Drupal stacks) provide ways to do this.

Similarly, it is useful to go through the trouble of abstracting DB settings and the like, both for security and to make it easier to move your code from one environment to the next.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.