---
title: wp-config.php
canonical: https://wpsecurityninja.com/dictionary/wp-config/
---
# wp-config.php

wp-config.php holds database credentials, keys, and core WordPress settings for the site.

Last updated: 2026-08-26

Also called: wp-config, wp config

## Related terms

- [Security hardening](https://wpsecurityninja.com/dictionary/security-hardening/): Hardening is the set of configuration and process changes that make a site harder to abuse.
- [Backdoor](https://wpsecurityninja.com/dictionary/backdoor/): A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- [SSL/TLS](https://wpsecurityninja.com/dictionary/ssl-tls/): SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- [WordPress salts](https://wpsecurityninja.com/dictionary/wordpress-salts/): WordPress salts are secret keys in wp-config.php that help secure cookies, nonces, and related cryptographic operations.
- [Core file integrity](https://wpsecurityninja.com/dictionary/core-file-integrity/): Core file integrity is the assurance that WordPress core files match known-good versions and have not been tampered with.

## Why it matters for WordPress

If `wp-config.php` leaks, attackers get database access and authentication salts. Malware also loves to inject PHP here because the file loads on every request. One quiet edit can persist long after you delete an obvious webshell.

## How it shows up in practice

- Database name, user, password, and table prefix in plain PHP constants
- `AUTH_KEY` and related salts that sign cookies and nonces
- Flags like `DISALLOW_FILE_EDIT`, `WP_DEBUG`, and custom memory limits
- Integrity alerts when the file changes and nobody deployed

## What to do

1. Keep the file outside the web root when the host supports it, or at least non-readable to the world.
2. Never commit real secrets to a public git repo.
3. Turn off public debugging on production (`WP_DEBUG` display off).
4. After a breach, rotate DB passwords and regenerate salts.
5. Watch integrity scans for unexpected edits to this file.