Skip to content
wp-skills
Register
tools/wp-config-generator

wp-config.php Generator

Build a complete wp-config.php: database credentials, eight freshly generated secret keys, debugging, file permissions, revisions, cron and update policy — every constant placed above the wp-settings.php require, which is the only place they have any effect.

Database

Some hosts want a port or a socket here, not just a hostname.

Left empty on almost every install; MySQL picks it from the charset.

Emitted as $table_prefix, a variable — wpdb reads it by name, and a config that defines a constant instead silently gets wp_.

Secret keys

All eight of the AUTH_KEY family are generated in your browser with crypto.getRandomValues(), 64 characters each, fresh every time this page loads — never on our server, so no two visitors are handed the same keys. Changing them logs everyone out, which is the recovery step after a leak rather than routine maintenance. Saving this as a snippet stores the keys with it.

Site address

Redirects wp-admin and wp-login.php to https.

Setting these overrides the home and siteurl options and disables the matching fields on Settings → General. Verified on WordPress 7.1: both inputs render with disabled='disabled' and the value from here — and with nothing on the screen saying why, so it is worth knowing before someone goes looking for the setting.

Debugging

Raises error_reporting to E_ALL. The two settings below are only read while this is on, so they are emitted only then.

Off on anything public: the alternative is printing file paths and stack traces to visitors.

Loads unminified core JS and CSS.

Records every query in $wpdb->queries. Costly; development only.

What wp_get_environment_type() reports. Core defaults to production when this is unset.

Files and limits

Removes the plugin and theme file editors, and nothing else: installing and updating still work.

Much wider. Verified on WordPress 7.1: it also denies install_plugins, update_plugins, update_core, install_themes, update_themes and delete_plugins — so plugin security updates can no longer be applied from the admin.

A string, compared literally in get_filesystem_method().

A shorthand string like 256M, not an integer — it goes through wp_convert_hr_to_bytes(), where a bare 256 means 256 bytes.

The ceiling admin-side work is allowed to raise itself to.

Content

Turning them off emits false. There is no separate zero: wp_revisions_to_keep() casts both to 0, so they are the same setting.

Seconds.

Days. Zero disables the trash, so deleting is permanent.

Cron

Stops page loads from running scheduled tasks. Only correct alongside a real system cron hitting wp-cron.php.

Seconds before a stalled cron run is considered abandoned.

Updates

Minor releases only is what core does when this is unset.

Turns off every automatic update — core, plugins, themes and translations.

Loads wp-content/advanced-cache.php. Read once, during wp-settings.php — a caching plugin usually writes this line itself.

wp-config.php
<?php
/**
 * The base configuration for WordPress.
 *
 * Every constant below is defined before the wp-settings.php require at the
 * bottom, which is where WordPress boots. A constant defined after that line
 * has no effect at all — core has already applied its own default, so the
 * second define() only raises "Constant X already defined".
 *
 * @link https://developer.wordpress.org/advanced-administration/wordpress/wp-config/
 */

/** Database settings — these come from your host. */
define( 'DB_NAME', 'database_name_here' );
define( 'DB_USER', 'username_here' );
define( 'DB_PASSWORD', 'password_here' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );
define( 'DB_COLLATE', '' );

/**#@+
 * Authentication unique keys and salts.
 *
 * Generated in your browser with crypto.getRandomValues(), 64 characters each.
 * Changing any of them invalidates every existing cookie, which logs everyone
 * out — that is the recovery procedure after a leak, not a routine edit.
 *
 * @since 2.6.0
 */
define( 'AUTH_KEY',          'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',   'put your unique phrase here' );
define( 'LOGGED_IN_KEY',     'put your unique phrase here' );
define( 'NONCE_KEY',         'put your unique phrase here' );
define( 'AUTH_SALT',         'put your unique phrase here' );
define( 'SECURE_AUTH_SALT',  'put your unique phrase here' );
define( 'LOGGED_IN_SALT',    'put your unique phrase here' );
define( 'NONCE_SALT',        'put your unique phrase here' );
/**#@-*/

/**
 * WordPress database table prefix.
 *
 * A variable rather than a constant: wpdb reads $table_prefix by name, and a
 * config that defines a constant instead falls back to 'wp_' without saying so.
 */
$table_prefix = 'wp_';

/** Debugging. */
define( 'WP_DEBUG', false );
define( 'WP_ENVIRONMENT_TYPE', 'production' );

/** File permissions and limits. */
define( 'DISALLOW_FILE_EDIT', true );

/* That's all, stop editing! Happy publishing. */

/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
	define( 'ABSPATH', __DIR__ . '/' );
}

/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';