WordPress-specific Dictionary
wp-config.php
Definition
wp-config.php holds database credentials, keys, and core WordPress settings for the site.
Also called: wp-config, wp config
Why it matters for WordPress
If wp-config.php leaks, attackers get database access and authentication salts. Malware also loves to inject PHP into this file because it loads on every request.
How it shows up in practice
- DB name, user, password, and table prefix
AUTH_KEYand related salts- Flags like
DISALLOW_FILE_EDITand debug settings
What to do
- Keep the file outside the web root when the host supports it, or at least non-readable to the world.
- Never commit real
wp-config.phpsecrets to public git. - Turn off public debugging on production.
- After a breach, rotate DB passwords and regenerate salts.
- Watch integrity scans for unexpected edits to this file.
Related terms
Nearby ideas in the dictionary
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- SSL/TLS SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.