wp-config.php file is the brain of your WordPress site; everything from your database passwords to your security keys is stored here. Below is a comprehensive template focused on both security and performance that you can copy directly and edit.
Secure wp-config.php Template
<?php
/**
* Security-focused WordPress configuration file
*/
// 1. Database details (fill in with the details from your panel)
define( 'DB_NAME', 'database_name' );
define( 'DB_USER', 'user_name' );
define( 'DB_PASSWORD', 'strong_password_here' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );
define( 'DB_COLLATE', '' );
/**
* 2. Unique security keys (salt keys)
* IMPORTANT: Generate new ones at the address below and replace these:
* https://api.wordpress.org/secret-key/1.1/salt/
*/
define('AUTH_KEY', 'random_characters_go_here');
define('SECURE_AUTH_KEY', 'random_characters_go_here');
define('LOGGED_IN_KEY', 'random_characters_go_here');
define('NONCE_KEY', 'random_characters_go_here');
define('AUTH_SALT', 'random_characters_go_here');
define('SECURE_AUTH_SALT', 'random_characters_go_here');
define('LOGGED_IN_SALT', 'random_characters_go_here');
define('NONCE_SALT', 'salt_goes_here');
/**
* 3. Database table prefix
* Use something complex instead of the default 'wp_' (e.g. 'wbev_72_')
*/
$table_prefix = 'wbev_72_';
/**
* 4. Security and hardening settings
*/
// Disable the file editor (blocks code changes from the admin panel)
define( 'DISALLOW_FILE_EDIT', true );
// Disable error display (gives attackers no clues)
define( 'WP_DEBUG', false );
@ini_set( 'display_errors', 0 );
// Limit revisions (keeps the database lean, improves performance)
define( 'WP_POST_REVISIONS', 5 );
// Empty the trash automatically (number of days)
define( 'EMPTY_TRASH_DAYS', 7 );
// Force SSL (for the admin panel)
define( 'FORCE_SSL_ADMIN', true );
/**
* 5. FTP/file system method
* Stops WordPress asking for FTP details when installing plugins
*/
define( 'FS_METHOD', 'direct' );
/** Defines the WordPress path */
if ( ! defined( 'ABSPATH' ) ) {
define( 'ABSPATH', __DIR__ . '/' );
}
/** Sets up WordPress variables and paths */
require_once ABSPATH . 'wp-settings.php';
Things to Watch Out For When Using This Template
-
Salt Keys (Security Keys): Be sure to replace the "random characters" parts in the example above with real keys from the WordPress.org API link. This is vital for encrypting session cookies.
-
Table Prefix: If you change the prefix (
$table_prefix) of an existing site, you must rename all tables in the database the same way. Before doing this, be sure to take a full backup. -
File Permissions:
wp-config.php– we recommend setting its permissions (CHMOD) to 400 or 440. This ensures the file can only be read by the server and prevents others from writing to it.
Extra Tip: Moving the File
If you want to take security to the highest level, you can move the wp-config.php file from the site's root directory (public_html) one directory up. WordPress automatically looks for this file in the directory above as well; this makes the file completely inaccessible from the web.
