RE: Is moving wp-config outside the web root really beneficial?
This question, and its accepted answer, lead readers to the dangerous conclusion that a common security practice – moving sensitive configuration files outside the web root – is dangerous, rather than beneficial.
The question incorrectly states that the practice is a security risk itself – and despite the asker acknowledging in a later comment that this is incorrect, the question has not been updated or redacted, nor the answers reconsidered.
The asker appears to be seeking agreement with his implied conclusion, not answers to his question. And the accepted answer reinforces the asker's conclusion by including a number of questionable security notions – it's no big deal if somebody gets their hands on your configuration files, it's no big deal if somebody gets into your database, and so on.
There are other answers, with more votes than the accepted answer, that disagree with the accepted answer; the question's asker has responded to them with incorrect information.
I've posted what I think is a very thorough answer that debunks the many myths throughout the question and its accepted answer; it immediately received a downvote, presumably from the asker, with no further comment.
Question:
Is it acceptable for a question and its accepted answer to specifically promote poor security practices? Where is the line drawn?
Obviously a question and answer designed to encourage an unknowing user to sudo rm -rf /
would be deleted (right?).
In this case, it's possible (though unlikely) that the authors of the question and accepted answer, and the accepted answer's upvoters, are using StackExchange to encourage poor security practices, in order to increase the ease with which WordPress installations can be exploited.
In the general case, it seems irresponsible to allow a question and its accepted answer to promote poor security practices.
"Obviously a question and answer designed to encourage an unknowing user to sudo rm -rf / would be deleted (right?)."
no.