I have this message when I login into my manager account
Config file still writable!
Your site is vulnerable to hackers who could do a lot of damage to the site. Please make your config file read only! If you are not the site admin, please contact a systems administrator and warn them about this message! It is located at
can anybody guide me on what I need to do so my site is safe?
You need to change the permissions on your configuration file to 400. It is located here: /core/config/config.inc.php
The file referred to is the core/config/config.inc.php file. You can make it read only, but a much better solution if to move the core directory above the web root so the core and any executable php files in or under it can't be reached from a browser.
After moving the core, you need to modify the three config.core.php files (MODX root, connectors, and manager directories).
There's more information here:
https://docs.modx.com/revolution/2.x/administering-your-site/security/hardening-modx-revolution
