What Is wp-config.php, and What Shouldn't Go in It?
What wp-config.php Actually Contains
This file sits in WordPress's root directory and defines the database connection details (host, name, username, password), a set of unique authentication security keys and salts (used to secure login cookies and sessions), the database table prefix, and various optional configuration constants (debug mode, memory limits, and others covered elsewhere). WordPress reads this file on every single request to know how to connect to its data.
Why This Needs Careful Handling
- Database credentials in plain text mean anyone who obtains this file's contents has direct access to the site's entire database, bypassing WordPress's own access controls entirely.
- Security keys and salts, if exposed, can potentially be used to forge valid-looking authentication cookies, a serious security risk if this file were ever leaked.
- A common, serious mistake is committing wp-config.php to a public GitHub repository, or including its full contents when asking for help in a public forum or support ticket — both expose these secrets to anyone who can view that content.
- The file's location and permissions matter too — it should never be publicly web-accessible (most hosting configurations correctly prevent this by default) and should have restrictive file permissions on the server.
Handling wp-config.php Safely
- Never commit it to any repository, public or private — use a template/example file with placeholder values in version control instead, keeping the real file server-side only.
- Redact credentials before sharing if you ever need to show wp-config.php's structure for troubleshooting purposes.
- Rotate database credentials and security keys if the file was ever accidentally exposed, since simply removing it from a public location afterward doesn't undo the exposure.
- Confirm proper file permissions and server configuration prevent direct web access to the file.
Concerned wp-config.php may have been exposed at some point? See WordPress bug fix for a proper security review.