WordPress configuration file wp-config.php contains your WordPress database login credentials. If it is compromised, then it will reveal information that could give a hacker complete access to your website.
You can add an extra layer of protection by denying access to wp-config file using .htaccess. Simply add this little code to your .htaccess file.
<files wp-config.php>
order allow,deny
deny from all
</files>