Default Wordpress .gitignore file

.gitignore

# This is a template .gitignore file for git-managed WordPress projects.
#
# Fact: you don't want WordPress core files, or your server-specific
# configuration files etc., in your project's repository. You just don't.
#
# Solution: stick this file up your repository root (which it assumes is
# also the WordPress root directory) and add exceptions for any plugins,
# themes, and other directories that should be under version control.
#
# See the comments below for more info on how to add exceptions for your
# content. Or see git's documentation for more info on .gitignore files:
# http://kernel.org/pub/software/scm/git/docs/gitignore.html

# CLEANING THE REPOSITORY
# If you've added this .gitignore file in an existing repository, you may want to remove the content that should be ignored. Here is how to do that.
# you can use a wildcard to remove all files, and then add all the files back, and then commit the updates.

# $ git commit -m "Pre Cleanup"
# $ git rm -r --cached .
# $ git add .
# $ git commit -m ".gitignore setup and cleaned up"


# Ignore everything in the root except the "wp-content" directory.
/*
!.gitignore
!wp-content/
!wp-config.php

# Ignore everything in the "wp-content" directory, except the "plugins"
# and "themes" directories.
wp-content/*
!wp-content/plugins/
!wp-content/themes/

# Ignore everything in the "plugins" directory, except the plugins you
# specify (see the commented-out examples for hints on how to do this.)
wp-content/plugins/*
# !wp-content/plugins/my-single-file-plugin.php
# !wp-content/plugins/my-directory-plugin/

# Ignore everything in the "themes" directory, except the themes you
# specify (see the commented-out example for a hint on how to do this.)
wp-content/themes/*
# !wp-content/themes/my-theme/

Just stumbled on this.. I don't think you mean to add !wp-config.php which has secure keys in it... The original gist that this was forked from does not include that file.

The best would be a big NOTE, that clarifies why it is not desied to track wp-config.php, and the few special use-cases where tracking wp-config.php is indeed desired. One such special case is, where the git repository is not visible, nor available publicly, and only authenticated users can access it.

Who about wp-config-sample.php
Maybe we need track this file

Just stumbled on this.. I don't think you mean to add !wp-config.php which has secure keys in it... The original gist that this was forked from does not include that file.

The best would be a big NOTE, that clarifies why it is not desied to track wp-config.php, and the few special use-cases where tracking wp-config.php is indeed desired. One such special case is, where the git repository is not visible, nor available publicly, and only authenticated users can access it.

FYI it's never a good practice to include secrets in a git repo. Even if the repository is private. The best thing to do would be to use environment variables or an additional secret file.

How to use environment variables or an secret file? Anyone please help me