---
title: wp-config.php
canonical: https://wpsecurityninja.com/dictionary/wp-config/
---
# wp-config.php

wp-config.php holds database credentials, keys, and core WordPress settings for the site.

## Why it matters for WordPress

If `wp-config.php` leaks, attackers get database access and authentication salts. Malware also loves to inject PHP here because the file loads on every request. One quiet edit can persist long after you delete an obvious webshell.

## How it shows up in practice

- Database name, user, password, and table prefix in plain PHP constants
- `AUTH_KEY` and related salts that sign cookies and nonces
- Flags like `DISALLOW_FILE_EDIT`, `WP_DEBUG`, and custom memory limits
- Integrity alerts when the file changes and nobody deployed

## What to do

1. Keep the file outside the web root when the host supports it, or at least non-readable to the world.
2. Never commit real secrets to a public git repo.
3. Turn off public debugging on production (`WP_DEBUG` display off).
4. After a breach, rotate DB passwords and regenerate salts.
5. Watch integrity scans for unexpected edits to this file.