The usual mitigation for safely using sqlite in PHP projects is as follows: - Have a .htaccess to block it. Only works with Apache of course but that covers mo

The usual mitigation for safely using sqlite in PHP projects is as follows: - Have a .htaccess to block it. Only works with Apache of course but that covers most shared hosting. - Have rewrite rules that takes precedence. Only works if the user enables url rewriting (automatic only on Apache) - Part of the sqlite database file name will be randomized. eg sqlite_xJ4D6e1E3.db. That usually works well but I suppose in theory it can be bruteforced... - The documentation will recommend it should be placed outside the webroot but the installer won't do it automatically because it can't safely assume the user has access to the parent folder. Realistically not that many people will end up doing that. I, for one, am still excited to no longer have to deal with questionable plugin to use wordpress on a mysql-free server.