Many security experts recommend focusing on core WordPress files before making other changes. It is a smart choice to protect wp-config.php because it contains sensitive website information. https://rankmywp.medium.com/the-one-wordpress-file-that-hands-over-the-whole-site-2427d02cf686