The wp-config.php File
wp-config.php is the most important settings file of WordPress. It sits in the root folder of your site. It tells WordPress how to connect to the database, and it holds many options as PHP constants. This file is not in the download zip, WordPress creates it during the install from wp-config-sample.php.
What is inside the file?
The sample file shows the constants which every site has:
$ grep -n "define(" wp-config-sample.php
23:define( 'DB_NAME', 'database_name_here' );
26:define( 'DB_USER', 'username_here' );
29:define( 'DB_PASSWORD', 'password_here' );
32:define( 'DB_HOST', 'localhost' );
35:define( 'DB_CHARSET', 'utf8mb4' );
38:define( 'DB_COLLATE', '' );
51:define( 'AUTH_KEY', 'put your unique phrase here' );
52:define( 'SECURE_AUTH_KEY', 'put your unique phrase here' );
53:define( 'LOGGED_IN_KEY', 'put your unique phrase here' );
54:define( 'NONCE_KEY', 'put your unique phrase here' );
55:define( 'AUTH_SALT', 'put your unique phrase here' );
56:define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
57:define( 'LOGGED_IN_SALT', 'put your unique phrase here' );
58:define( 'NONCE_SALT', 'put your unique phrase here' );
88:define( 'WP_DEBUG', false );
98: define( 'ABSPATH', __DIR__ . '/' );
$ grep -n "table_prefix" wp-config-sample.php
74:$table_prefix = 'wp_';
| Constant | Meaning |
|---|---|
| DB_NAME, DB_USER, DB_PASSWORD | Database name and login |
| DB_HOST | Database server, usually localhost on shared hosting |
| DB_CHARSET, DB_COLLATE | Character set. Keep utf8mb4 and leave the collate empty |
| AUTH_KEY and other keys and salts | Random strings which protect the login cookies |
| $table_prefix | The start of all table names, wp_ by default |
| WP_DEBUG | Turns the debug mode on or off |
Security keys and salts
The keys and salts make the login cookies hard to guess. You can create a fresh set from the WordPress.org secret key service, or with WP-CLI by running wp config shuffle-salts. When you change them, all users are logged out, which is good after a hack.
Table prefix
Because of the prefix, many WordPress sites can live in one database. A different prefix instead of wp_ is a small extra step against simple attacks, but it does not replace real security.
$ wp config get table_prefix
wp_
$ wp db prefix
wp_
Useful constants
| Constant | Example | What it does |
|---|---|---|
| WP_DEBUG | define( 'WP_DEBUG', true ); | Show PHP errors and notices. Only for development |
| WP_MEMORY_LIMIT | define( 'WP_MEMORY_LIMIT', '256M' ); | Memory for WordPress scripts |
| WP_POST_REVISIONS | define( 'WP_POST_REVISIONS', 5 ); | How many revisions to keep (false turns them off) |
| DISALLOW_FILE_EDIT | define( 'DISALLOW_FILE_EDIT', true ); | Removes the theme and plugin file editor from the dashboard |
| AUTOMATIC_UPDATER_DISABLED | define( 'AUTOMATIC_UPDATER_DISABLED', true ); | Turns off all automatic updates |
| WP_HOME and WP_SITEURL | define( 'WP_HOME', 'https://example.com' ); | Forces the site addresses |
| FORCE_SSL_ADMIN | define( 'FORCE_SSL_ADMIN', true ); | Login and admin only over HTTPS |
| WP_ENVIRONMENT_TYPE | define( 'WP_ENVIRONMENT_TYPE', 'local' ); | One of local, development, staging or production |
Read and change the file with WP-CLI
You do not have to open the file by hand. WP-CLI can read and write the constants. Here we add one, read it and remove it again:
$ wp config set WP_POST_REVISIONS 5 –raw
Success: Added the constant 'WP_POST_REVISIONS' to the 'wp-config.php' file with the raw value '5'.
$ wp config get WP_POST_REVISIONS
5
$ wp config delete WP_POST_REVISIONS
Success: Deleted the constant 'WP_POST_REVISIONS' from the 'wp-config.php' file.
$ wp config has WP_POST_REVISIONS || echo "removed"
removed
$ wp config get WP_ENVIRONMENT_TYPE
local
| Exercises & Assignments |
|---|
| No Content Found. |
| Interview Questions & Answers |
|---|
| No Content Found. |