What Is the wp-config.php File in WordPress? Complete 2026 Guide

Every WordPress site has one small file that quietly runs the whole show. It is called wp-config.php. Most site owners never open it. Yet nothing on your site would load without it.

This guide explains what wp-config.php does, where it lives, and what each part of it means. You will also learn which settings are safe to change, and which ones you should leave alone. No coding background needed.

What Is wp-config.php ?

Think of wp-config.php as your site’s ID card and instruction sheet rolled into one. It tells WordPress how to connect to its database. It also stores a handful of switches that change how WordPress behaves.

When someone visits your homepage, WordPress reads this file first. It grabs the database name, the username, and the password. Then it opens the database and pulls your posts, pages, settings, and menus. Only then does your page appear in the browser.

The file itself is plain text with PHP code inside it. It is short, often under 100 lines. But every line matters.

Why It Is Not Part of the Database

People often ask why these settings are not stored in the database with everything else. The answer is simple. WordPress cannot read the database until it knows how to reach the database. So those details have to sit outside it, in a file.

Where Is the wp-config.php File Located?

You will find wp-config.php in the root folder of your WordPress install. That is the same folder that holds wp-admin, wp-includes, and wp-content.

Depending on your host, the root folder may be called public_html, htdocs, www, or something similar. You can reach it in three common ways:

• File manager in your hosting panel. The easiest route for most people. Log in, open the file manager, and browse to your site folder.
• An FTP or SFTP client. Connect with the credentials your host gave you, then open the site directory.
• SSH command line. Best for developers who are comfortable in a terminal.

One useful detail: WordPress will also look one level above the root folder. Some site owners move wp-config.php up a directory on purpose. Public visitors cannot browse that level, so the file becomes a little harder to reach.

What About wp-config-sample.php?

Fresh WordPress downloads include a file named wp-config-sample.php. It is a template. During installation, WordPress copies it, fills in your database details, and saves the result as wp-config.php. The sample file stays behind and does nothing. You can leave it or delete it.

What Is Inside wp-config.php?

The file breaks into a few clear sections. Here is what each one does.

1. Database Connection Settings

These four lines are the heart of the file:

• DB_NAME is the name of your database.
• DB_USER is the database username.
• DB_PASSWORD is that user’s password.
• DB_HOST is the server address, usually localhost.

If any one of these is wrong, your site shows a connection error instead of your content. That is the single most common reason people end up editing this file. Our walkthrough on fixing the database connection error covers exactly what to check.

2. Security Keys and Salts

Next comes a block of eight long random strings. They have names like AUTH_KEY and NONCE_SALT. These are your security keys.

WordPress uses them to scramble the login cookies stored in visitors’ browsers. Strong, unique keys make stolen cookies far harder to reuse. If you ever suspect an account has been compromised, replacing these strings logs every user out at once. It is a quick, powerful reset.

3. Table Prefix

One line sets the table prefix, which defaults to wp_. Every database table your site creates starts with it. Multiple WordPress installs can then share one database without clashing.

Changing this on a live site is risky. It requires renaming tables and updating stored values at the same time. Pick your prefix at install time and leave it alone afterwards.

4. Debug Mode

The line defining WP_DEBUG controls whether WordPress prints errors on screen. On a live site it should stay false. Error messages can reveal file paths and other details you would rather keep private.

When you are troubleshooting, a safer pattern is to switch debugging on but send the output to a log file instead of the browser. You get the diagnostic detail without showing it to visitors.

5. The Stop Line

Near the bottom sits a comment that says to stop editing. Anything you add must go above that line. Code placed below it will not run, because WordPress has already finished loading by that point.

Useful Settings You Can Add

WordPress supports dozens of optional constants. Here are the ones site owners reach for most often.

Lock Down the Built-In File Editor

By default, an administrator can edit theme and plugin code straight from the dashboard. That is convenient, and also dangerous. If an admin account is ever breached, the attacker can inject code in seconds.

Turning off the file editor removes that path entirely. It is one of the highest-value changes you can make in this file. For the wider picture, see our guide on how secure WordPress really is.

Force HTTPS on the Admin Area

A single constant tells WordPress to serve wp-admin and the login page over HTTPS only. Passwords then travel encrypted every time. Pair it with a proper certificate and a habit of hardening your login page.

Control Post Revisions

WordPress saves a copy of a post every time you save it. On a busy blog that adds up fast, and the database swells. You can cap revisions at a sensible number, such as five, or switch them off completely.

Raise the Memory Limit

Some themes and plugins need more memory than the default allows. Raising the PHP memory limit here often clears white-screen errors and failed imports. Your host still sets a hard ceiling, so check with them if the change has no effect.

Set the Autosave Interval

The editor autosaves your draft every 60 seconds by default. You can stretch that out to reduce server requests, which helps on shared hosting.

Move the Uploads Folder

You can point media uploads to a different directory. This is handy when you want your images on a separate volume or a custom path.

How to Edit wp-config.php Safely

This file has no undo button. One stray character can take your whole site offline. Follow these steps every time.

1. Back up first. Download a copy of wp-config.php to your computer. Take a fresh database backup too, so you can roll back cleanly.
2. Use a code editor. Plain text editors are fine. Word processors are not, because they add invisible formatting that breaks PHP.
3. Add lines above the stop comment. Never below it.
4. Watch the syntax. Every statement ends with a semicolon. Quotes must be straight, not curly. Do not leave blank lines or spaces before the opening PHP tag.
5. Save and test. Reload your homepage and your dashboard right away. If something breaks, restore the copy you saved in step one.

Common Mistakes to Avoid

• Pasting code below the stop line and wondering why nothing happens.
• Using curly quotes copied from a website or a document.
• Leaving a stray space after the final closing tag, which causes header warnings.
• Defining the same constant twice with different values.
• Editing the live site with no backup at all.

Keeping wp-config.php Secure

This file holds your database password in plain text. Treat it as one of the most sensitive files you own.

Tighten File Permissions

Standard files sit at 644, which lets others on the server read them. Setting wp-config.php to 440 or 400 restricts read access to the owner. Most hosts allow this without any trouble.

Block Direct Web Access

Add a rule to your server configuration that denies web requests for this filename. Visitors then get a forbidden response instead of a download prompt, even if the server is misconfigured.

Move It Up One Level

Shifting the file one directory above your web root keeps it outside the publicly served folder. WordPress still finds it automatically. This works well on servers where you control the directory layout.

Rotate Your Keys Periodically

Generating fresh security keys once or twice a year is good practice. It costs you nothing but a forced logout, and it invalidates any session an attacker may be holding.

Keep It Out of Version Control

If your site lives in a Git repository, exclude this file. Committing it publishes your database password to everyone with repository access.

What to Do When wp-config.php Goes Missing

A missing file sends WordPress into installation mode. You will see the setup screen instead of your site. Do not run the installer, because that can overwrite live data.

Instead, restore the file from a backup. If you have no backup, copy wp-config-sample.php, rename it, and fill in your database credentials by hand. You can find those in your hosting panel under database settings. Once the details match, your site returns exactly as it was, because all your content still lives safely in the database.

Do You Ever Need to Touch This File?

Honestly, many site owners never do. Modern hosting sets it up correctly on day one, and good plugins handle their own settings through the dashboard.

You will most likely open it when you migrate a site to a new host, when you are chasing a stubborn error, or when you are hardening security. Outside those moments, the best thing you can do with wp-config.php is leave it alone. If you are still building your foundations, our step-by-step WordPress guide for beginners is a good place to start.

Key Takeaways

• wp-config.php stores your database credentials and core WordPress settings.
• It sits in the root folder, alongside wp-admin and wp-includes.
• Security keys protect login cookies, and refreshing them logs everyone out.
• Optional constants can disable the file editor, force HTTPS, and trim revisions.
• Always back up before editing, and always add code above the stop line.
• Tight file permissions and blocked web access keep the file safe.

Need a Hand With Your Configuration?

Editing core files makes a lot of people nervous, and that caution is fair. A single typo can take a site down at the worst possible moment. If you would rather not risk it, our team can handle it for you. We harden configuration files, fix connection errors, and keep WordPress sites running smoothly around the clock. Visit 24×7 WP Support and let us take the technical worry off your plate in 2026.