Key Takeaways

• Location: wp-config.php lives in your WordPress root directory, one level above the wp-admin folder.
• Never commit to version control: It contains secrets. Add it to .gitignore.
• Security keys are non-negotiable: Regenerate them if your site is ever compromised.
• Debug mode should always be off on production: But turn it on when troubleshooting — and never leave it on.
• A single typo can take your site down: Always back up wp-config.php before editing.

What Is wp-config.php?

Where does it live?

wp-config.php is a plain-text PHP configuration file located in the root directory of your WordPress installation (the same folder that contains wp-login.php and wp-content/). It is not the same as wp-config-sample.php, which is a template included with every WordPress download.

What does it control?

This one file orchestrates how WordPress connects to your database, how it authenticates users, where it stores temporary data, and how it behaves in development versus production. Every major setting below flows through this file:

Common wp-config.php Problems & How to Fix Them

Problem 1: "Error Establishing a Database Connection"

This is the #1 reason sites go offline. It almost always means your database credentials in wp-config.php are wrong, or the database server is unreachable.

Checklist — troubleshoot in order:

1. Verify DB_NAME, DB_USER, and DB_PASSWORD match your hosting control panel (cPanel, Plesk, etc.).
2. Confirm DB_HOST is correct — some hosts use an IP address or a subdomain like mysql.example.com instead of localhost.
3. Test the database credentials directly via phpMyAdmin or the MySQL CLI.
4. Check that the database user has privileges on the specified database.
5. Ensure the MySQL service is running on the server.

Problem 2: White Screen of Death After Editing wp-config.php

A missing semicolon, an extra space, or a typo in any line will produce a blank white page. PHP parses the file from top to bottom — the first syntax error stops everything.

Fix: Restore from your backup, then re-add changes one line at a time. The most common mistakes are:

• Forgetting the trailing semicolon (;) at the end of a line.
• Adding a comma after the last constant before require_once.
• Typo in a constant name (e.g., DB_HST instead of DB_HOST).
• Extra blank lines or whitespace between closing ?> and the next line.

Problem 3: Stuck in a Redirect Loop

If you recently changed WP_SITEURL or WP_HOME, your site may enter an infinite redirect loop between http and https, or between www and non-www.

Fix: Remove or comment out both WP_SITEURL and WP_HOME lines from wp-config.php, then update the URLs properly through the WordPress admin or your hosting panel.

Problem 4: Memory Exhaustion Errors

Errors like "Allowed memory size of 33554432 bytes exhausted" mean WordPress needs more PHP memory than currently allocated.

Fix — add this line above That's all, stop editing!:

define('WP_MEMORY_LIMIT', '256M');

If your host enforces a hard PHP memory cap, contact them — wp-config.php cannot override server-level limits.

Problem 5: Login Cookies Not Working (Brute-Force Vulnerability)

If your authentication salts are default, missing, or have been exposed, attackers can forge login cookies. This is a critical security risk.

Fix: Regenerate all authentication unique keys and salts at the WordPress.org secret-key service, then replace the existing AUTH_KEY through NONCE_SALT block in wp-config.php. Log out of all sessions immediately after.

wp-config.php Security Hardening Checklist

Apply these settings to significantly reduce your attack surface. Each one addresses a real, documented vulnerability vector.