WordPress wp-config.php: What It Does and How to Edit It

wp-config.php is the file that tells WordPress how to connect to its database and how to run. It normally sits in the root folder of your install, next to wp-admin and wp-content. You can safely add or change settings above the “That’s all, stop editing!” line, and you should leave the two blocks of code below that line alone. Keep a backup first, because a single typo can take the whole site down.

Key takeaways

• The file holds your database password and security keys, so treat it like a password and never post its contents in a forum or support chat.
• Custom settings go above the “stop editing” line. The last line below it loads WordPress, and a setting after that line comes too late.
• Your download of WordPress includes wp-config-sample.php. The real wp-config.php is created during setup.
• Don’t change $table_prefix on a live site by editing that line alone. WordPress will act as if it isn’t installed.

Where to find wp-config.php

Connect over SFTP or open your host’s file manager, then go to the folder that holds wp-admin, wp-includes and wp-content. The WordPress documentation calls this the root of your WordPress file directory.

If it isn’t there, look one folder up. WordPress’s loader checks the install folder first, then the parent folder, and it skips the parent if that folder has its own wp-settings.php, because that means another WordPress install lives there.

If neither place has the file, WordPress sends visitors to its setup screen. That screen builds the file from wp-config-sample.php. When it can’t write to the folder, it shows you the text to paste into a new file by hand.

What each default section does

wp-config-sample.php is the template, and it has these parts in this order:

Section	What it holds	Can you change it?
DB_NAME, DB_USER, DB_PASSWORD, DB_HOST	The database login. The sample uses localhost as the host, and your web host can give you the real values.	Yes, when your database details change. A wrong value causes the error establishing a database connection.
DB_CHARSET, DB_COLLATE	How database text is stored. The defaults are utf8mb4 and an empty value.	The sample’s own comment for DB_COLLATE says not to change it if in doubt.
AUTH_KEY through NONCE_SALT	Eight security keys and salts used for login cookies.	Yes. Changing them logs every user out.
$table_prefix	The text at the start of each database table name, wp_ by default.	Only at install time, unless you also rename the tables and update saved database entries whose names use the prefix.
WP_DEBUG	Debug mode, set to false in the sample.	Yes. See the WordPress debug mode guide.
The “custom values” comment	An empty space for your own settings, ending at the “stop editing” line.	Yes, this is where your additions go.
ABSPATH and the wp-settings.php line	The path to WordPress, then the line that loads the rest of it.	No. Leave these as they are.

New keys are one click away: the WordPress.org secret-key service gives you a fresh set each time you load it. Replace all eight lines with the new set.

Older files may lack the “custom values” comment and say “Happy blogging” instead of “Happy publishing”. Both still work, and the rule stays the same: add your settings above that line.

Settings people commonly change

Each of these is one line. All of them come from the wp-config.php documentation, and the defaults come from WordPress’s default-constants.php.

// Memory for the front end, then for wp-admin
define( 'WP_MEMORY_LIMIT', '256M' );
define( 'WP_MAX_MEMORY_LIMIT', '512M' );

// Keep at most 3 revisions per post (false turns revisions off)
define( 'WP_POST_REVISIONS', 3 );

// Autosave every 180 seconds
define( 'AUTOSAVE_INTERVAL', 180 );

// Empty the trash after 7 days
define( 'EMPTY_TRASH_DAYS', 7 );

// Remove the theme and plugin file editor from wp-admin
define( 'DISALLOW_FILE_EDIT', true );

// Force HTTPS for logins and wp-admin
define( 'FORCE_SSL_ADMIN', true );

// Set the site addresses here
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Copy only the lines you need. A few of them have details worth knowing:

• Memory: WordPress defaults to 40M, or 64M on multisite, and to 256M for wp-admin unless PHP already allows more. If your host doesn’t allow the limit to be changed, WordPress uses the limit PHP already has. The memory exhausted guide covers what to do when that happens.
• Revisions: these are on by default. Set false to turn them off, or a number to cap them.
• Autosave and trash: the defaults are 60 seconds and 30 days. Setting EMPTY_TRASH_DAYS to 0 turns the trash off, and the documentation warns that WordPress then won’t ask for confirmation when someone clicks “Delete Permanently”.
• File editor: the hardening guide says this won’t stop an attacker from uploading malicious files, though it might stop some attacks. DISALLOW_FILE_MODS goes further and also blocks plugin and theme installs and updates.
• HTTPS: when your WordPress Address setting already starts with https, WordPress sets FORCE_SSL_ADMIN to true by itself. This line only changes something when that address doesn’t start with https.
• Site addresses: these override the saved values without changing what is stored in the database. Include the https:// part.

One setting needs more planning. define( 'DISABLE_WP_CRON', true ); stops page visits from starting scheduled tasks, so set up a server cron job for wp-cron.php before you turn it on, or scheduled posts and other timed jobs won’t run.

How to edit wp-config.php safely

1. Download a copy first. Keep it on your own computer. A copy left on the server under a name like wp-config.php.bak may be readable in a browser, because the server no longer treats it as PHP.
2. Open the file in a plain text editor. WordPress’s editing guide lists Notepad++, Sublime Text and Visual Studio Code as acceptable. It warns against Google Docs and Microsoft Word because word processors change quote marks and can add code that breaks files.
3. Find the “stop editing” line and put your new lines directly above it. If the setting is already defined higher up, change that line.
4. Save and upload, then load your site in a private browser window, along with one page in wp-admin.
5. If something breaks, put your copy back. That undoes the edit even when wp-admin won’t load.

Moving the file above the web root

The hardening guide says wp-config.php can be stored one folder above your WordPress install, and the loader code handles that with no extra settings. Move the file, then check that the site still loads. The move has two limits:

• The parent folder can’t hold another WordPress install. The loader ignores a parent folder that has its own wp-settings.php.
• One level up is only private if WordPress sits at the web root. If WordPress lives in a subfolder such as /blog/, one level up is usually still public.

The same guide says some people argue that the move has minimal security benefits, and that it may introduce serious vulnerabilities if done carelessly. So treat it as optional. On Apache, the guide also gives this block for the top of your .htaccess file, which denies direct requests to the file:

<Files "wp-config.php">
Require all denied
</Files>

Our .htaccess security guide covers that rule alongside others.

File permissions for wp-config.php

The WordPress docs give slightly different numbers, depending on the situation:

• The hardening guide says only you and the web server should be able to read the file, which it says generally means 400 or 440.
• The file permissions guide says 440 or 400 on shared hosting with suexec, to keep other users on the server from reading it. It also shows 600 as a secured example.
• For ordinary WordPress files, that guide says 644 or 640.

Which number works depends on which system user your web server runs as. The web server has to be able to read the file, so if the site stops loading after a change, go back to the previous value and ask your host which one fits their setup.

Common mistakes

• Pasting a setting after the wp-settings.php line. That line loads WordPress and sets its defaults. A PHP constant can’t change during a script’s run, so your line has no effect.
• Defining the same setting twice. The first line sets the value and the second can’t change it. PHP’s manual says redeclaring a constant is deprecated as of PHP 8.5, so it can also trigger a message. Search the file for the name before you add it.
• Putting quotes around true or false. 'false' is a non-empty string, and PHP treats that as true. Write false with no quotes. Sizes like '256M' do need them.
• Curly quotes from a word processor or a web page. PHP needs straight quotes, so curly ones cause an error that stops the site from loading.
• Showing debug errors on a live site. WP_DEBUG_DISPLAY defaults to true, so if you turn on WP_DEBUG alone, errors appear on the page for visitors. The debug log location guide shows how to send them to a file.
• Leaving WP_ALLOW_REPAIR on. The documentation says to enable it only when needed and to disable it once the issue is solved.

FAQ

What is wp-config.php in WordPress? It is the configuration file WordPress loads on startup. It holds your database login, security keys and table prefix, and it is where you add settings such as WP_DEBUG or WP_MEMORY_LIMIT.

Where is the wp-config.php file located? Normally in the root of your WordPress install, the folder that also holds wp-admin, wp-includes and wp-content. WordPress also accepts it one folder above the install, as long as that folder has no wp-settings.php.

Where do I add code in wp-config.php? Above the line that says That’s all, stop editing! Happy publishing. Older files say Happy blogging. The last line below it loads WordPress, so a setting placed after that line comes too late.

Is it safe to edit wp-config.php? Yes, if you keep a backup and use a plain text editor. A single typo can stop the whole site from loading, including wp-admin, so download a copy first. If the site breaks after your edit, put the copy back.

What happens if I delete wp-config.php? WordPress can no longer find its database login and starts its setup process, with a prompt to create a configuration file. Your content stays in the database, so restoring the backup or recreating the file with the same details reconnects the site.

What permissions should wp-config.php have? WordPress’s hardening guide says only you and the web server should be able to read it, which generally means 400 or 440. Its file permissions guide also shows 600. The web server still has to read the file, so check with your host if the site stops loading.

Sources

• WordPress Advanced Administration: wp-config.php, Hardening WordPress, File permissions, Editing files
• WordPress source code: wp-config-sample.php, wp-load.php, default-constants.php, setup-config.php, cron.php
• PHP manual: Constants, Booleans

---

Build the settings you need without hand-typing them, including fresh security keys, with the free wp-config.php generator.