WordPress-specific Dictionary
wp-config.php
Definition
wp-config.php holds database credentials, keys, and core WordPress settings for the site.
Also called: wp-config, wp config
Why it matters for WordPress
If wp-config.php leaks, attackers get database access and authentication salts. Malware also loves to inject PHP here because the file loads on every request. One quiet edit can persist long after you delete an obvious webshell.
How it shows up in practice
- Database name, user, password, and table prefix in plain PHP constants
AUTH_KEYand related salts that sign cookies and nonces- Flags like
DISALLOW_FILE_EDIT,WP_DEBUG, and custom memory limits - Integrity alerts when the file changes and nobody deployed
What to do
- Keep the file outside the web root when the host supports it, or at least non-readable to the world.
- Never commit real secrets to a public git repo.
- Turn off public debugging on production (
WP_DEBUGdisplay off). - After a breach, rotate DB passwords and regenerate salts.
- Watch integrity scans for unexpected edits to this file.
Related terms
Nearby ideas in the dictionary
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- SSL/TLS SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- WordPress salts WordPress salts are secret keys in wp-config.php that help secure cookies, nonces, and related cryptographic operations.
- Core file integrity Core file integrity is the assurance that WordPress core files match known-good versions and have not been tampered with.
