I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings.php in the .gitignore because it contains sensitive database info, namely as login credentials.

My local database is open to anyone, so the commented-out privileges portion in the default settings.php file doesn't seem to matter now. However, the database on the live server will have a proper username/password combo. To my (limited) knowledge, it sounds like I'll have to put these in setting.php in order for my site to be able to log in.

My question is: Why is it safe to put these credentials in the public www folder under /sites/default/settings.php but not put them in Git? Is that not safe either? What's the proper, secure way to give my site access to my database?

  • You can put a file on the server containing these variables and include them in settings.php without literally adding them to the file. – Kevin Jan 24 at 1:23
  • How can I have a file that contains those variables without "literally adding them to the file"? I'm confused. – GraphicsMuncher Jan 24 at 1:35
  • Because you’d add a require/include() statement in settings.php which has the database connection defined. It’s not in git and as long as the server is properly secured, protected from the outside. – Kevin Jan 24 at 1:58
  • 1
    settings.php in Git is not technically insecure, its the human factor that makes it dangerous: Many people use free, public repositories on GitHub or GitLab and simply forget to remove the credentials before pushing their code into the repository. – Hudri Jan 24 at 6:23
  • 1
    Where exactly can the included file and the settings.php file live settings.php needs to be where it is, the included file can be literally anywhere on (or off) the server that the web server user has access to. As others have mentioned, having settings.php in git is not inherently insecure. Acquia/Pantheon/etc require it, for example, and they’re perfectly secure. There isn’t a right or wrong answer to this, as long as the way you’ve decided to implement it is a secure one. Requiring a file that only exists locally with those credentials in, is a common way to solve the problem. – Clive Jan 24 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.