wp-config Security Template

wp-config.php is the settings file of your WordPress site; your database details and security keys are stored in it. The template below contains the settings we recommend for security and performance.

Secure wp-config.php template

<?php
// 1. Database details (from Plesk > Databases)
define( 'DB_NAME', 'database_name' );
define( 'DB_USER', 'user_name' );
define( 'DB_PASSWORD', 'strong_password' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );
define( 'DB_COLLATE', '' );

// 2. Security keys: paste the 8 lines you get from
//    https://api.wordpress.org/secret-key/1.1/salt/
define( 'AUTH_KEY',         'put-your-unique-phrase-here' );
define( 'SECURE_AUTH_KEY',  'put-your-unique-phrase-here' );
define( 'LOGGED_IN_KEY',    'put-your-unique-phrase-here' );
define( 'NONCE_KEY',        'put-your-unique-phrase-here' );
define( 'AUTH_SALT',        'put-your-unique-phrase-here' );
define( 'SECURE_AUTH_SALT', 'put-your-unique-phrase-here' );
define( 'LOGGED_IN_SALT',   'put-your-unique-phrase-here' );
define( 'NONCE_SALT',       'put-your-unique-phrase-here' );

// 3. Table prefix (on a new install, instead of the default wp_)
$table_prefix = 'wbev72_';

// 4. Security settings
define( 'DISALLOW_FILE_EDIT', true );   // theme/plugin code cannot be edited from the dashboard
define( 'FORCE_SSL_ADMIN', true );      // admin area over https only
define( 'WP_DEBUG', false );            // errors are not shown to visitors
@ini_set( 'display_errors', 0 );

// 5. Performance
define( 'WP_POST_REVISIONS', 5 );       // at most 5 revisions per post
define( 'EMPTY_TRASH_DAYS', 7 );        // trash is emptied after 7 days

if ( ! defined( 'ABSPATH' ) ) {
    define( 'ABSPATH', __DIR__ . '/' );
}
require_once ABSPATH . 'wp-settings.php';

When applying the template

File permissions

Set the permissions of wp-config.php to 400 or 440 so the file can only be read. In Plesk File Manager, use Change Permissions on the file's row. If your site stops working, set it to 640.

Extra measure: moving the file one folder up

WordPress also looks for wp-config.php one folder up. If you move the file from httpdocs to the folder above it (the home directory), it cannot be reached from the web at all. Check your site after moving it; if there is a problem, move the file back.

Related articles: Security tips for WordPress sites, .htaccess tips for WordPress sites