Key Takeaways

• Understanding the differences between legacy and the new wp-config.php structure.
• Step‑by‑step checklist to migrate safely without downtime.
• Best‑in‑class security settings (salts, keys, file permissions, and environment variables).
• Performance tweaks that reduce DB overhead and improve load times.
• Answers to the three most common questions about the new configuration file.

Problem‑Solver Q&A Architecture

Why does my site break after updating wp‑config.php?

Most breakages stem from one of three issues:

1. Syntax errors: Missing commas, unmatched quotes, or stray whitespace before /* That's all, stop editing! */.
2. Incorrect constant names: The new file uses DB_HOST, DB_USER, DB_PASSWORD, and DB_NAME exactly as shown. Typos will cause a fatal error.
3. File permission problems: The file must be readable by the web server (typically 640 or 600) but not writable by the public.

How can I keep my credentials out of version control?

Use environment variables or a separate .env file and reference them in wp-config.php:

define( 'DB_NAME', getenv('WP_DB_NAME') );
define( 'DB_USER', getenv('WP_DB_USER') );
define( 'DB_PASSWORD', getenv('WP_DB_PASSWORD') );
define( 'DB_HOST', getenv('WP_DB_HOST') );

Then add the .env file to .gitignore. This approach is recommended for any CI/CD pipeline.

What are the essential security constants I should add?

Beyond the default authentication salts, the new best practice list includes:

• DISALLOW_FILE_EDIT – disables the theme/plugin editor.
• DISALLOW_FILE_MODS – blocks plugin/theme updates from the dashboard (useful on locked production servers).
• FORCE_SSL_ADMIN – forces admin traffic over HTTPS.
• WP_AUTO_UPDATE_CORE – controls automatic core updates.

Legacy vs. New wp-config.php Settings

Migration Checklist – From Old to New wp-config.php

1. Backup the current wp-config.php and the entire site.
2. Create a staging copy of the site to test changes.
3. Replace hard‑coded credentials with getenv() calls or a secure .env file.
4. Generate fresh authentication salts using WordPress.org secret‑key API.
5. Add the recommended security constants (DISALLOW_FILE_EDIT, FORCE_SSL_ADMIN, etc.).
6. Set file permissions to 640 (owner) and ensure the web‑server user can read the file.
7. Enable WP_DEBUG only on staging; keep it disabled on production.
8. Test site functionality: login, admin dashboard, front‑end, and any custom plugins that read config values.
9. Deploy to production and monitor error logs for 24 hours.
10. Document the new configuration in a README for future developers.

Frequently Asked Questions

Can I keep the old wp-config.php file and create a new one?

Yes. WordPress will load the file named wp-config.php in the root directory. You can keep a backup named wp-config-old.php for reference, but never place two active config files in the same directory.

Do I need to update the ABSPATH constant when moving wp-config.php?

No. ABSPATH is automatically set by WordPress based on the location of wp-config.php. If you relocate the file outside the root (a recommended hardening step), you must define ABSPATH manually before requiring wp-settings.php.

What is the best way to version‑control wp-config.php?

Store a template file (e.g., wp-config.sample.php) with placeholders for secrets. Keep the real wp-config.php out of the repository and generate it during deployment using CI variables or a provisioning script.