Question 1

What is wp-config.php and why is it important?

Accepted Answer

wp-config.php is the core configuration file for every WordPress installation. It contains: database connection credentials (host, name, user, password); security keys and salts for cookie encryption; table prefix for database tables; debug mode settings; and optional advanced constants that control caching, file editing, SSL and autosave behavior. It sits in the WordPress root directory. Because it contains database credentials, it is a high-value target for attackers — hardening its location, permissions and contents is a foundational security step.

Question 2

What security constants should I add to wp-config.php?

Accepted Answer

Recommended security constants for wp-config.php: define('DISALLOW_FILE_EDIT', true) — disables the Appearance → Editor in wp-admin, preventing attackers with admin access from editing theme files; define('DISALLOW_FILE_MODS', true) — blocks plugin and theme installation/updates from wp-admin (only safe if you can update via SFTP/SSH); define('FORCE_SSL_ADMIN', true) — forces wp-admin and wp-login.php over HTTPS; define('WP_DEBUG', false) — ensures error messages (which can reveal file paths) are never shown publicly; define('WP_AUTO_UPDATE_CORE', true) — enables automatic minor version security updates.

Question 3

Should I move wp-config.php out of the WordPress root?

Accepted Answer

WordPress automatically looks for wp-config.php one directory above the WordPress root (e.g., if WordPress is at /public_html/, it will check /public_html/../wp-config.php = /wp-config.php). Moving it one level up keeps it outside the web-accessible directory on most hosting setups, so even if .htaccess fails to block direct access, the file isn't browsable. This is supported natively by WordPress — no code changes needed. However, on some hosting configurations (especially where WordPress is installed in a subdirectory), this may not provide additional protection.

Question 4

What file permissions should wp-config.php have?

Accepted Answer

wp-config.php should be set to 640 or 600 permissions. 600 (owner read/write only) is the most restrictive and is recommended on servers where WordPress and the web server run as the same user. 640 (owner read/write, group read) is needed if the web server user is different from the file owner. Never use 644 (world-readable) — it allows any user on a shared hosting server to read your database credentials. Set via: chmod 640 wp-config.php in SSH, or via your hosting control panel's file manager.

wp-config.php Generator

Security constants included

Frequently asked questions

Related WordPress tools

Start every install with a hardened config

Constant	Value	Effect
DISALLOW_FILE_EDIT	true	Disables Appearance → Theme Editor and Plugins → Editor in wp-admin
DISALLOW_FILE_MODS	true	Blocks plugin and theme installation, updates and deletion from wp-admin
FORCE_SSL_ADMIN	true	Forces wp-admin and wp-login.php over HTTPS regardless of request URL
WP_DEBUG	false	Suppresses PHP error output (file paths, credentials) from public display
WP_AUTO_UPDATE_CORE	true	Enables automatic minor security updates (e.g., 6.4.1 → 6.4.2)
WP_POST_REVISIONS	5	Limits stored post revisions to 5 — reduces database bloat