What is wp-config.php?

When you download WordPress, the wp-config.php file won’t be included. Once you provide your details during the installation process, WordPress creates the file for you.

You can also build the file yourself. WordPress includes a sample version called wp-config-sample.php in the root folder: copy or rename it to wp-config.php, then fill in the database name, username, password, and host your web host gave you. Our manual WordPress installation guide walks through every step.

One typo in this file can take your whole site offline, so most site owners never touch it. Legitimate reasons do come up: your host walks you through a troubleshooting step, you want to turn on debug mode, or your database credentials changed after a migration. Save a backup copy before any change. The WordPress Advanced Administration Handbook gives the same advice: practice regular backups and know how to restore them before modifying these settings.

What wp-config.php controls

The required settings connect WordPress to its database. Optional constants then change how the site behaves. The ones you’ll meet most often:

• Database connection: the name, username, password, and host of the database that stores your content, usually MySQL.
• Table prefix: the $table_prefix value, wp_ by default, that starts every database table name.
• Security keys and salts: 8 unique phrases that strengthen the cookies WordPress uses for logins.
• Site URLs: WP_SITEURL and WP_HOME hard-code your site’s address instead of reading it from the database, which helps when you move a site.
• Debug mode: WP_DEBUG turns on the display of errors and notices while you troubleshoot.
• Limits and lockdowns: further constants increase the memory allocated to PHP or disable the plugin and theme file editor in the dashboard (DISALLOW_FILE_EDIT).

Code snippets that change how your theme looks or behaves don’t belong here; those go in functions.php or a plugin.

Where to find wp-config.php

The file sits in the root directory of your WordPress installation, in the same folder as wp-admin and wp-content. You can reach it with an SFTP client (the secure replacement for plain FTP) or your hosting panel’s file manager. On hosts that run cPanel, the root folder is usually named public_html. DreamHost doesn’t use cPanel: in our panel, your site’s files live in a directory named after your domain.

How to edit wp-config.php safely

1. Connect to your server with an SFTP client, or open your hosting panel’s file manager, and download a copy of wp-config.php. That copy is your undo button. It also holds your database password, so store it somewhere private and delete it once the job is done.
2. Edit the file in a plain-text editor such as Notepad++ or Sublime Text. Never use a word processor like Microsoft Word; it adds formatting that breaks PHP.
3. Upload the edited file to the root directory, overwriting the original, and reload your site.
4. If anything breaks, upload the untouched copy from step 1 to reverse the change.

When wp-config.php breaks

Three failures cover most cases:

• Wrong database credentials: WordPress shows “Error establishing a database connection.” Re-check the 4 database values against the ones your host lists.
• A PHP syntax error: one missing quote or semicolon can take the site down with a fatal error or a blank white screen. Restore your backup copy and the site comes back.
• A missing file: WordPress reports “There doesn’t seem to be a wp-config.php file” and offers to create one, a common sight after a botched migration. Re-create it from wp-config-sample.php with your database details.

Protecting wp-config.php

wp-config.php stores your database password in plain text, which makes it a favorite target for attackers. The WordPress hardening documentation dedicates a section to securing it. Start with file permissions: set the strictest values your host supports so other accounts on the server can’t read the file. The right settings vary from host to host, so follow your host’s own instructions. If your site runs on the Apache web server, you can also block web requests to the file with an .htaccess rule; our guide to the WordPress .htaccess file includes a copy-and-paste snippet that denies that access. That rule works only on Apache-compatible servers: if yours runs Nginx, ask your host to add the equivalent block to the server configuration.