- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
wp-config.php contains important WordPress configuration and commonly includes database credentials and security keys.
Exposure or unauthorized modification can compromise the website.
Protect Stored Secrets
The file can contain:
- Database name.
- Database username.
- Database password.
- Database host.
- Authentication keys and salts.
- Debug settings.
- Environment-specific constants.
- Integration secrets added by custom code.
Do not paste the file into public issue trackers or screenshots.
File Location and Permissions
WordPress supports selected configurations where wp-config.php can be placed one directory above the WordPress root.
Whether this provides benefit depends on server layout. Correct permissions and web-server configuration remain essential.
Security Keys and Salts
Use strong unique values.
Rotating keys invalidates active sessions and can be useful after suspected compromise. Coordinate rotation with incident response because it signs users out.
Debug Configuration
Production sites should not display detailed PHP or WordPress errors to visitors.
Log errors to a protected location with appropriate retention and access controls.
Database Credentials
Use a dedicated database account with only the privileges required for the WordPress database.
Rotate credentials after compromise and update the configuration atomically to avoid downtime.
Version Control and Deployment
Do not commit production secrets to a public repository.
Use environment-specific configuration, secret management or deployment injection where appropriate.
Frequently Asked Questions
Does moving wp-config.php guarantee protection?
No. Server configuration, permissions and secret handling still matter.
When should salts be changed?
Rotate them during incident response, credential resets or when exposure is suspected.
Continue Learning
Previous: [WordPress File and Directory Permissions](/resources/wordpress-manual/security/file-directory-permissions/)
Next: [WordPress Database Security](/resources/wordpress-manual/security/database-security/)