wp-config.php is the first file WordPress reads on every request. It tells WordPress how to reach the database and lets you switch features on or off with constants. Knowing what is in it makes most WordPress problems much easier to fix.
Before you start
- Open cPanel → Files → File Manager and find
wp-config.phpin the site's root folder. - Right-click it and choose Download to keep a copy before you edit.
- Edit with Edit (plain text). A single missing quote or semicolon breaks the whole site.
Database settings
define( 'DB_NAME', 'user_wp' );
define( 'DB_USER', 'user_wpuser' );
define( 'DB_PASSWORD', 'strong-password' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );On MdmHost the database host is always localhost, and the database and user names include your cPanel username prefix. If you change the database user's password in cPanel, update DB_PASSWORD at the same time.
Table prefix
$table_prefix = 'wp_'; sets the start of every table name. Several WordPress installs can share one database if each has a different prefix. Never change the prefix on a live site without also renaming the tables and the prefixed option and usermeta keys.
Security keys and salts
The eight lines starting with AUTH_KEY to NONCE_SALT sign login cookies. Replace them with new random values from the official WordPress salt generator to log out every user at once, for example after a hack or when a former admin leaves.
Useful constants
| Constant | Example | What it does |
|---|---|---|
WP_DEBUG | false | Shows PHP errors; use with WP_DEBUG_LOG when troubleshooting |
WP_MEMORY_LIMIT | '256M' | Memory WordPress may request, up to the PHP limit |
WP_HOME / WP_SITEURL | 'https://example.com' | Overrides the site address stored in the database |
DISALLOW_FILE_EDIT | true | Removes the plugin and theme code editor |
WP_POST_REVISIONS | 10 | Limits stored revisions per post |
DISABLE_WP_CRON | true | Stops visitor-triggered cron when you use a real cron job |
WP_AUTO_UPDATE_CORE | 'minor' | Controls automatic core updates |
FORCE_SSL_ADMIN | true | Forces HTTPS for logins and the dashboard |
EMPTY_TRASH_DAYS | 7 | Days before trashed posts are deleted |
Where to put new lines
Add custom constants above the line /* That's all, stop editing! Happy publishing. */. Anything placed after require_once ABSPATH . 'wp-settings.php'; is read too late to have an effect.
Protect the file
- Set permissions to
600or640in File Manager with Permissions. - Never share the file in a support forum without removing the password and salts.
- If you use Git, keep
wp-config.phpout of the repository.
Troubleshooting
- White page after editing: a syntax error. Upload your saved copy or fix the line you changed.
- "Headers already sent" warning: there is whitespace or text before
<?phpat the top of the file. - Changes have no effect: the constant is defined twice (the first definition wins) or it was added below the
wp-settings.phpline. - Installer keeps asking for database details:
wp-config.phpis missing or in the wrong folder. WordPress also looks one level above the site root.
Moving wp-config.php up one level
WordPress automatically finds wp-config.php in the folder above the site root. On cPanel that means moving it from public_html to your home directory, outside the web root. This adds a small layer of protection if PHP ever stopped working and served files as plain text. It only works for the site installed directly in public_html, and only if no other WordPress install sits in the parent folder.
Editing over SSH
If you have SSH access, you can also read and set constants with WP-CLI, which avoids syntax mistakes:
wp config set WP_MEMORY_LIMIT 256MUse wp config list to see every defined value, which is a quick way to spot duplicates.