Every WordPress installation includes files that should never be freely available to everyone online. That is why many users decide to protect wp-config.php as part of their website protection plan. https://rankmywp.medium.com/the-one-wordpress-file-that-hands-over-the-whole-site-2427d02cf686