What is wp-config.php and why is it so important?

The wp-config.php in the root directory is the control centre of every WordPress install. It holds the database credentials, the security keys and a range of constants that control the behaviour and security of the site. Because so much comes together here, it's a worthwhile target for attackers – and at the same time one of the most effective places to increase security with just a few lines.

Which constants harden WordPress?

The most important are DISALLOW_FILE_EDIT (disables the code editor in the backend), FORCE_SSL_ADMIN (forces HTTPS for login and backend), WP_DEBUG set to false on live sites, and freshly set security keys (AUTH_KEY and co.) that invalidate stolen sessions. In addition, WP_POST_REVISIONS limits revisions and WP_AUTO_UPDATE_CORE controls automatic core updates.

What does DISALLOW_FILE_EDIT do?

The constant disables the built-in code editor for themes and plugins in the WordPress backend. The benefit: even if an attacker takes over an administrator account, they can no longer write malicious code directly into theme or plugin files via the backend. It's one of the most effective single measures and has no practical downside for most sites, because the editor is rarely used meaningfully anyway.

Can I safely edit wp-config.php?

With care, yes. Because a single typo in this file can take the whole site down, the rule before every change is: back up the file first, then edit. New constants belong above the line That's all, stop editing. If you're unsure, it's better to test the change on a staging copy first.

Hardening wp-config.php: The Most Important Security Constants

The wp-config.php in the root directory is the control centre of your WordPress install. It holds not only the database credentials but also a range of constants that make the site considerably safer with just a few lines. Here’s what they are and what they do:

The Most Important Hardening Constants

DISALLOW_FILE_EDIT – disables the code editor in the backend. A hijacked admin account can then no longer write malicious code directly into a theme or plugin. One of the most effective single measures.
FORCE_SSL_ADMIN – forces the backend and login to run encrypted (HTTPS) only. Protects credentials in transit.
WP_DEBUG = false – on live sites, no error messages should be visible to visitors; they needlessly reveal details about the system.
WP_POST_REVISIONS – limits revisions per post and keeps the database lean (performance + security).
WP_AUTO_UPDATE_CORE – controls automatic core updates (see using auto-updates properly).
Security keys (AUTH_KEY & co.) – these salts encrypt session cookies. Resetting them invalidates all existing sessions – ideal after a suspicion or hack.

Generator: Build Your Hardening Block

Pick the options, copy the block and add it above the line “That’s all, stop editing!” in your wp-config.php:

wp-config.php Hardening

Generate security constants

Pick options, copy the block – add it above "That's all, stop editing!". All in your browser.

Disable the in-dashboard file editor DISALLOW_FILE_EDIT – prevents editing theme/plugin code via the dashboard. Admin over HTTPS only FORCE_SSL_ADMIN – enforces encrypted logins. No debug output on live sites WP_DEBUG = false – no error messages for visitors.

Limit post revisions WP_POST_REVISIONS – keeps the database lean.

Max revisions

Control automatic core updates WP_AUTO_UPDATE_CORE – minor (recommended), all or none.

Block all file changes DISALLOW_FILE_MODS – also blocks plugin/theme/core updates. Set deliberately only. Generate new security keys AUTH_KEY & co. – generated randomly in the browser. Replaces old keys (logs everyone out).

Everything runs locally in the browser. Make a backup before editing wp-config.php.

Important: make a backup before any change to wp-config.php. A typo in this file can take the whole site down.

Two Constants to Handle with Care

Not every hardening fits every setup. Two constants you should only set with a clear reason:

DISALLOW_FILE_MODS blocks all file changes – including plugin, theme and core updates. That makes sense in tightly controlled setups where updates run exclusively through a deployment process. Set it without that process and security updates stop happening – then the constant does more harm than good.
DISALLOW_UNFILTERED_HTML stops even administrators from inserting unfiltered HTML/JavaScript. In editorial teams with many authors this raises security, but it can block legitimate embeds (certain embed codes, for example) – check first whether your workflow can handle it.

Not Just Constants: The Storage Location Matters

Beyond the constants, the file itself is worth a look. Restrictive file permissions (typically 600 or 640) prevent other users on the server from reading it. On many setups, wp-config.php can also be moved one level above the web root, so it isn’t reachable via the browser at all. Both are optional, but a sensible addition for security-critical sites.

How It Fits Together

wp-config hardening is one layer of several. Together with a secured login and regular updates, it forms protection that lets the most common attacks run into nothing. Incidentally, the same file also controls the WordPress memory limit – a different constant, the same approach.

Want wp-config.php and the whole setup properly secured? Drop us a line – we’ll harden it without updates or features suffering.