What is the wp-config.php file and what does it do?

The wp-config.php file is WordPress's main configuration file. It tells WordPress how to connect to its database, stores the security keys that protect logins and cookies, and holds site-wide settings such as debug mode, memory limits, and automatic update behavior. Without it, WordPress cannot load at all, which is why it is one of the most important files on your server.

Most site owners never need to touch it, but knowing what it does helps you troubleshoot problems, harden security, and fine-tune performance. In this article you will learn where wp-config.php lives, what each default section means, how to edit it safely, and the most useful constants you can add.

What Is wp-config.php?

wp-config.php is a PHP file that WordPress loads very early in every request, before plugins, themes, or most of core. It defines constants (named values that cannot change once set) that control how WordPress behaves.

Unlike themes and plugins, it is not overwritten when you update WordPress. That makes it the right place for configuration that should stay the same across updates.

Where Is the wp-config.php File Located?

By default, it lives in the root folder of your WordPress installation, alongside folders such as wp-admin, wp-content, and wp-includes:

public_html/
├── wp-admin/
├── wp-content/
├── wp-includes/
├── index.php
├── wp-config.php
└── wp-login.php

WordPress also looks one directory above the root. Moving the file there is a common hardening step on some servers, as long as that folder is not itself another WordPress installation.

When you first download WordPress, there is no wp-config.php. Instead, there is wp-config-sample.php. The installer creates wp-config.php for you, or you can copy the sample file and fill it in manually.

How to Access and Edit wp-config.php

There is no option in the WordPress dashboard to edit this file, which is intentional. You can open it with:

1. SFTP: Connect with a client such as FileZilla or Cyberduck, download the file, edit it in a code editor, and upload it again.
2. Your host's file manager: Most control panels, including cPanel and Plesk, include a file manager with a built-in editor.
3. SSH: Edit the file directly on the server with an editor such as nano or vim.
4. WP-CLI: Change values with commands such as wp config set.

Before editing, always download a backup copy of the current file. A single missing semicolon or quote will cause a critical error that takes the whole site offline. Keeping the original lets you restore it in seconds.

The Most Important Rule

New constants must be added above this line:

/* That's all, stop editing! Happy publishing. */

Anything after that comment runs after WordPress has already loaded its settings, so constants defined there will be ignored or cause warnings.

Understanding the Default Sections

A fresh wp-config.php contains several sections. Here is what each one does.

Database Settings

define( 'DB_NAME', 'database_name_here' );
define( 'DB_USER', 'username_here' );
define( 'DB_PASSWORD', 'password_here' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );
define( 'DB_COLLATE', '' );

• DB_NAME: The name of the MySQL or MariaDB database.
• DB_USER and DB_PASSWORD: The credentials WordPress uses to connect.
• DB_HOST: The database server. Often localhost, but some hosts use a hostname, an IP address, or a custom port such as localhost:3307.
• DB_CHARSET: The character set. utf8mb4 supports all characters, including emojis and many non-Latin scripts.
• DB_COLLATE: The collation. Leave it empty to let WordPress choose.

If any of these values are wrong, you will see the "Error establishing a database connection" message.

Authentication Keys and Salts

define( 'AUTH_KEY',         'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
define( 'NONCE_KEY',        'put your unique phrase here' );
define( 'AUTH_SALT',        'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
define( 'NONCE_SALT',       'put your unique phrase here' );

These eight random strings are used to encrypt the information stored in login cookies and to generate nonces. Long, unique values make it much harder for attackers to forge cookies.

You can generate a fresh set from the official WordPress.org secret-key service at https://api.wordpress.org/secret-key/1.1/salt/, or with WP-CLI:

wp config shuffle-salts

Changing the keys immediately logs out every user on the site. That makes it a useful step after a suspected security breach.

Database Table Prefix

$table_prefix = 'wp_';

This prefix is added to every WordPress table name, so the posts table becomes wp_posts. It lets you run multiple WordPress sites in a single database. Changing the prefix on an existing site requires renaming tables and updating some option and user meta values, so do not change it casually.

Debug Mode

define( 'WP_DEBUG', false );

When set to true, WordPress reports PHP errors, warnings, and notices. It should be false on production sites and true while developing.

Loading WordPress

if ( ! defined( 'ABSPATH' ) ) {
define( 'ABSPATH', __DIR__ . '/' );
}

require_once ABSPATH . 'wp-settings.php';

These final lines define the absolute path to your WordPress directory and load the rest of WordPress. Never remove or change them.

Useful wp-config.php Settings

Beyond the defaults, WordPress supports dozens of constants. These are the ones you are most likely to need. Add each one above the "stop editing" line.

Debugging Settings

For troubleshooting, log errors to a file instead of showing them to visitors:

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', 0 );

Errors are written to wp-content/debug.log. You can also give WP_DEBUG_LOG a file path, such as a location outside the public web root, so the log cannot be downloaded.

define( 'SCRIPT_DEBUG', true );

SCRIPT_DEBUG makes WordPress load unminified core CSS and JavaScript, which is helpful when debugging editor or admin issues.

define( 'SAVEQUERIES', true );

This records every database query for analysis. It slows down the site, so only use it temporarily.

Setting the Environment Type

define( 'WP_ENVIRONMENT_TYPE', 'staging' );

Accepted values are local, development, staging, and production. Plugins and themes can check wp_get_environment_type() to behave differently, for example disabling emails or analytics on staging.

Site and Home URLs

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

These override the WordPress Address and Site Address values in Settings > General. They are useful when moving a site or when a wrong URL has locked you out of the dashboard. While defined, the fields in Settings become read-only.

Increasing the Memory Limit

define( 'WP_MEMORY_LIMIT', '256M' );
define( 'WP_MAX_MEMORY_LIMIT', '512M' );

WP_MEMORY_LIMIT sets how much memory WordPress can use on the front end, and WP_MAX_MEMORY_LIMIT applies to admin tasks like image processing. If you see "Allowed memory size exhausted" errors, raising these can help. Your hosting plan's PHP memory limit still sets the upper boundary, so if the change has no effect, ask your host.

Controlling Post Revisions

define( 'WP_POST_REVISIONS', 10 );

This limits how many revisions WordPress stores per post. Use false to disable revisions entirely, though keeping a small number is usually wiser, since revisions let you recover earlier versions of content.

Autosave Interval

define( 'AUTOSAVE_INTERVAL', 120 );

The number of seconds between autosaves in the editor. The default is 60.

Emptying the Trash Automatically

define( 'EMPTY_TRASH_DAYS', 14 );

Trashed posts, pages, and comments are permanently deleted after this many days. The default is 30.

Automatic Update Settings

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

Accepted values are:

• true: Install all core updates, including major releases.
• 'minor': Install only minor and security releases (the default behavior).
• false: Disable automatic core updates.

To disable every kind of automatic update, including plugins and themes:

define( 'AUTOMATIC_UPDATER_DISABLED', true );

Only do this if you have a reliable manual update process, because security fixes will no longer install on their own.

Disabling the File Editor

define( 'DISALLOW_FILE_EDIT', true );

This removes the Theme File Editor and Plugin File Editor from the dashboard. If an attacker ever gains admin access, they cannot use these editors to inject code. This is one of the simplest hardening steps you can take.

To go further and block plugin and theme installation and updates from the dashboard as well:

define( 'DISALLOW_FILE_MODS', true );

This is common on sites deployed through Git or managed by a development team, but it also disables one-click updates, so make sure updates happen some other way.

Forcing SSL in the Admin

define( 'FORCE_SSL_ADMIN', true );

This ensures logins and admin sessions always use HTTPS.

If your site sits behind a load balancer or proxy that terminates SSL, WordPress may not detect HTTPS correctly and you can end up in a redirect loop. Adding this before the constant usually fixes it:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
$_SERVER['HTTPS'] = 'on';
}

Controlling WP-Cron

WordPress runs scheduled tasks (publishing scheduled posts, checking for updates, and so on) when visitors load pages. On busy or very quiet sites, it is often better to run them from a real server cron job:

define( 'DISABLE_WP_CRON', true );

Then add a system cron job, for example every five minutes:

*/5 * * * * cd /var/www/example.com/public_html && wp cron event run --due-now > /dev/null 2>&1

Do not disable WP-Cron without setting up a replacement, or scheduled posts and other tasks will stop running.

Enabling Caching

define( 'WP_CACHE', true );

This tells WordPress to load wp-content/advanced-cache.php, which page caching plugins such as WP Rocket, W3 Total Cache, and WP Super Cache use. Caching plugins usually add this line for you when you activate them.

Changing the Content Directory

define( 'WP_CONTENT_DIR', __DIR__ . '/app' );
define( 'WP_CONTENT_URL', 'https://example.com/app' );

These move the wp-content folder to a custom location. It is mostly used in custom development setups such as Bedrock. Moving it on an existing site requires updating URLs in the database, so plan carefully.

Allowing Multisite

define( 'WP_ALLOW_MULTISITE', true );

This unlocks the Tools > Network Setup screen, which walks you through converting a single site into a WordPress Multisite network. WordPress then gives you additional constants to paste into wp-config.php and rules for .htaccess.

Repairing the Database

define( 'WP_ALLOW_REPAIR', true );

This enables a database repair screen at /wp-admin/maint/repair.php. The page does not require you to be logged in, so remove the constant as soon as you are done.

Editing wp-config.php with WP-CLI

WP-CLI can read and change constants without opening the file:

# List all defined constants and variables
wp config list

# Get one value
wp config get WP_DEBUG

# Set a constant (booleans need --raw)
wp config set WP_DEBUG true --raw
wp config set WP_MEMORY_LIMIT 256M

# Remove a constant
wp config delete SAVEQUERIES

Using --raw stores the value as PHP code (true) rather than a string ('true'), which matters for boolean settings.

How to Secure wp-config.php

Because the file contains your database password and security keys, protect it carefully.

• Set strict file permissions: 640 or 600 is common, depending on how your server runs PHP. At minimum, the file should never be writable by other users. Check with your host if you are unsure.

chmod 640 wp-config.php

• Block direct web access: PHP files are normally executed rather than displayed, but if PHP ever fails, the raw file could be served. On Apache, add this to the .htaccess file in your WordPress root:

<Files wp-config.php>
    Require all denied
</Files>

On Nginx, add this inside your server block:

location ~* /wp-config\.php$ {
    deny all;
}

• Use strong, unique database credentials: Do not reuse the database password anywhere else.
• Refresh your salts after an incident: Run wp config shuffle-salts or paste new keys from the WordPress.org generator.
• Keep it out of public repositories: If your site is in Git, add wp-config.php to .gitignore or load secrets from environment variables.

Loading Secrets from Environment Variables

On modern hosting, you can keep credentials out of the file entirely:

define( 'DB_NAME', getenv( 'WP_DB_NAME' ) ?: '' );
define( 'DB_USER', getenv( 'WP_DB_USER' ) ?: '' );
define( 'DB_PASSWORD', getenv( 'WP_DB_PASSWORD' ) ?: '' );
define( 'DB_HOST', getenv( 'WP_DB_HOST' ) ?: 'localhost' );

This approach is common with containers and deployment pipelines, where secrets are managed by the platform.

Common wp-config.php Errors

Error establishing a database connection: Check DB_NAME, DB_USER, DB_PASSWORD, and DB_HOST against the values in your hosting control panel.

Critical error after editing: Usually a syntax mistake, such as a missing semicolon, quote, or parenthesis. Restore your backup copy and redo the change carefully.

Settings have no effect: The constant was probably added below the "stop editing" line, or it is defined twice. Make sure each constant appears only once and above the comment.

Headers already sent: Remove any spaces or blank lines before the opening <?php tag.

Curly quotes: Copying code from a word processor can replace straight quotes (') with curly ones (’), which PHP does not understand. Always use a plain-text code editor.

---

FAQ: wp-config.php

---

Conclusion

The wp-config.php file is the foundation of every WordPress site. It connects WordPress to its database, secures logins with unique keys and salts, and controls important behavior such as debugging, memory, revisions, updates, and cron. A few well-chosen constants can make your site more secure, easier to troubleshoot, and better suited to your hosting environment.

Treat this file with care: back it up before every change, add new settings above the "stop editing" line, and protect it with strict permissions. With those habits, wp-config.php becomes a powerful tool rather than a source of anxiety.