Wordpress wp-config file permissions are 664, should be 640 I think. This is the first thing I changed after migrating our sites here. 664 means the DB credentials are readable by any bot, malware scanner, or public user. We got hacked 10 years ago on this very setting being open to the public.