View Plans
Help

wp-config.php: what it does and how to edit it

wp-config.php is the WordPress configuration file. It holds your database details, security keys, table prefix and settings such as debugging and the memory limit. It sits in the WordPress root folder, usually public_html. Back it up, then edit it in cPanel File Manager or over FTP, adding changes above the “stop editing” line.

Updated · HostUpIndia team

Where wp-config.php is and how to edit it

wp-config.php sits in the WordPress root folder, next to wp-admin and wp-content. On cPanel that is usually public_html. If it is not there, look one folder above, which WordPress also checks.

Edit it in cPanel File Manager, or download it over SFTP or FTP, edit it in a plain-text editor and upload it back. A word processor can add characters that break the file.

  • Sign in to cPanel and open File Manager.
  • Open the folder WordPress is in, usually public_html.
  • Select wp-config.php and click Download, so you have a copy to put back.
  • Click Edit to open the file.
  • Add or change the lines you need, then click Save Changes.
  • Reload your site. If it breaks, upload the copy you downloaded.

Database settings in wp-config.php

These lines tell WordPress how to reach its database, each in the form define( 'DB_NAME', 'example_wp' );. They must match the database and user in cPanel › Manage My Databases (MySQL Databases in older cPanel).

  • DB_NAME: the database name, including the prefix cPanel adds, such as username_.
  • DB_USER: the database user, with the same prefix.
  • DB_PASSWORD: that user’s password.
  • DB_HOST: the database server, usually localhost on cPanel. Use another value only if your host gives you one.
  • DB_CHARSET and DB_COLLATE: the character set and collation, usually utf8mb4 and empty. Leave them as they are.
  • A wrong value stops the site with “Error establishing a database connection”. See how to fix the database connection error.

Authentication keys and salts

Eight lines, from AUTH_KEY to NONCE_SALT, secure the login cookies. New keys sign everyone out, so change them after a hack or a leaked password. If the site was hacked, see how to clean and secure it.

  • Open https://api.wordpress.org/secret-key/1.1/salt/ in your browser. It shows eight new random lines on each visit.
  • In wp-config.php, select the eight lines from AUTH_KEY to NONCE_SALT.
  • Paste the new lines over them and save.
  • Sign in again. Every other user must sign in again too.
  • Never reuse keys from another site or a tutorial.

Turn on debugging with WP_DEBUG

WP_DEBUG makes WordPress report PHP errors. Turn it on to find a fault, write the errors to a log, and keep them off the page.

  • Find define( 'WP_DEBUG', false ); and change false to true. If there is no such line, add define( 'WP_DEBUG', true ); above the “stop editing” line.
  • Below it, add define( 'WP_DEBUG_LOG', true ); to write errors to wp-content/debug.log.
  • Add define( 'WP_DEBUG_DISPLAY', false ); so visitors do not see the errors.
  • Reload the page with the problem and read wp-content/debug.log.
  • When you are done, set WP_DEBUG back to false and remove the two lines you added.
  • Delete wp-content/debug.log. Anyone who knows its address can read it.

Other wp-config.php settings

Add your own settings above /* That's all, stop editing! Happy publishing. */. WordPress loads after that line, so a setting below it comes too late.

  • $table_prefix: the start of every table name, wp_ by default. Change it only before you install. On a live site the tables and some rows inside them must be renamed too.
  • WP_HOME and WP_SITEURL: the site address and the WordPress address. Set both, such as define( 'WP_HOME', 'https://example.com' );, to fix a wrong address when you cannot reach the dashboard. While they are set, Settings › General cannot change them. A wrong address can cause a redirect loop: fix too many redirects.
  • WP_MEMORY_LIMIT: the memory WordPress asks PHP for, such as define( 'WP_MEMORY_LIMIT', '256M' );. Your host’s own limits still apply. See how to increase the WordPress memory limit.
  • DISALLOW_FILE_EDIT: define( 'DISALLOW_FILE_EDIT', true ); removes the theme and plugin file editors from the dashboard, so a stolen admin login cannot change code there.
  • WP_AUTO_UPDATE_CORE: 'minor' installs security and maintenance releases only, true adds major releases, and false turns automatic core updates off. Keep updates on.

Safe wp-config.php permissions

wp-config.php holds your database password and keys. Give it the tightest permissions your site still runs with, and never share it.

  • In File Manager, select wp-config.php and click Permissions.
  • Set it to 440 or 400, then load your site.
  • If the site stops loading, or your host does not allow it, use 640 or 600 instead.
  • To edit the file later, set it to 600 first, then set it back.
  • Never paste the file into a forum, a chat or a public code repository. If it was exposed, change the database password and the keys.
  • Keep copies such as wp-config.php.bak out of public_html. A copy that does not end in .php can be downloaded as plain text.

HostUpIndia WordPress hosting

HostUpIndia WordPress plans come with WordPress pre-installed on LiteSpeed, NVMe storage, cPanel and free SSL. Edit wp-config.php in cPanel File Manager, and restore it from daily backups kept 30 days if an edit goes wrong.

  • From ₹149 a month on 3-year billing. Prices exclude 18% GST. See WordPress plans.
  • Support tickets and email are received 24 hours a day, 7 days a week; WhatsApp is open for questions from 10 am to 7 pm IST, Monday to Saturday.
  • Free website migration by the HostUpIndia in-house team.
  • More help guides.