wp-config.php holds your database credentials, but it’s also where you set constants that change how WordPress behaves: security restrictions, performance limits, debugging and environment settings. Here are the ones worth knowing, with recommended values for a WordPress site on a VPS.

Where to put them: above the line /* That's all, stop editing! Happy publishing. */. Constants defined after wp-settings.php loads have no effect.

Security

// Block the theme and plugin file editors in wp-admin
define( 'DISALLOW_FILE_EDIT', true );

// Block installing and updating plugins/themes from wp-admin (use WP-CLI or deployments instead)
// define( 'DISALLOW_FILE_MODS', true );

// Force HTTPS for logins and the admin area
define( 'FORCE_SSL_ADMIN', true );

// Behind a proxy or load balancer that terminates TLS
if ( ( $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '' ) === 'https' ) {
    $_SERVER['HTTPS'] = 'on';
}
  • DISALLOW_FILE_EDIT should be on everywhere. If an admin account is compromised, the attacker can’t simply paste PHP into your theme.
  • DISALLOW_FILE_MODS suits managed setups where updates happen via WP-CLI or Git. It also hides update notices.

Salts and keys: the AUTH_KEY … NONCE_SALT lines should be long random strings. Regenerate them (which logs everyone out) after a security incident:

wp config shuffle-salts

See WordPress hardening.

Performance and resources

// Memory for front-end and admin requests
define( 'WP_MEMORY_LIMIT', '256M' );
define( 'WP_MAX_MEMORY_LIMIT', '512M' );   // admin and heavy tasks

// Don't run WP-Cron on visitor requests (use a real cron job instead)
define( 'DISABLE_WP_CRON', true );

// Fewer revisions and slower autosave
define( 'WP_POST_REVISIONS', 10 );
define( 'AUTOSAVE_INTERVAL', 120 );         // seconds

// Empty trash sooner
define( 'EMPTY_TRASH_DAYS', 14 );

// Persistent object cache (Redis) settings used by the Redis Object Cache plugin
define( 'WP_REDIS_HOST', '127.0.0.1' );
define( 'WP_CACHE_KEY_SALT', 'example.com:' );

Notes:

  • WP_MEMORY_LIMIT can’t exceed PHP’s own memory_limit. See WordPress memory limit.
  • With DISABLE_WP_CRON, add a system cron job, or scheduled posts and tasks stop running. See WordPress real cron.
  • WP_CACHE is set to true by page cache plugins. Don’t add it manually unless your cache plugin says so.
  • Redis settings: see Redis object cache.

Environment and debugging

define( 'WP_ENVIRONMENT_TYPE', 'production' );   // or 'staging', 'development', 'local'

define( 'WP_DEBUG', false );
define( 'WP_DEBUG_LOG', false );
define( 'WP_DEBUG_DISPLAY', false );

WP_ENVIRONMENT_TYPE lets plugins behave differently on staging, for example not sending emails or not indexing. When troubleshooting, see WordPress debug mode.

Updates

// Core auto-updates: true (all), 'minor' (default; security releases), false (none)
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

See WordPress automatic updates and update WordPress safely.

URLs and paths

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

These override the database values. They’re useful during migrations, or when locked out. See change the WordPress site URL.

Moving wp-content or the uploads folder is possible (WP_CONTENT_DIR, WP_CONTENT_URL, UPLOADS), but rarely worth the plugin compatibility issues.

Database

define( 'DB_CHARSET', 'utf8mb4' );
$table_prefix = 'wp_';           // set only at install time; changing later needs a migration
define( 'WP_ALLOW_REPAIR', true ); // enables /wp-admin/maint/repair.php — remove right after use

Protect wp-config.php itself

  • Permissions 640 or 600, owned by the PHP user. See WordPress file permissions.
  • WordPress also finds wp-config.php one directory above the WordPress root, which keeps it out of the web root on single-site installs.
  • Deny web access in Nginx: location ~* wp-config\.php { deny all; }.

Edit it with WP-CLI

wp config list
wp config set WP_POST_REVISIONS 10 --raw
wp config set DISALLOW_FILE_EDIT true --raw
wp config get WP_DEBUG

--raw writes the value without quotes (for booleans and numbers). See WP-CLI guide.

Quick reference

Constant Recommended
DISALLOW_FILE_EDIT true
FORCE_SSL_ADMIN true
WP_MEMORY_LIMIT / WP_MAX_MEMORY_LIMIT 256M / 512M
DISABLE_WP_CRON true + system cron
WP_POST_REVISIONS 10
WP_ENVIRONMENT_TYPE production / staging

Related: WordPress VPS performance tuning and WordPress VPS hosting.

  • WordPress
  • Security
  • Performance