wp-config.php — Glossary

The longer version

It holds the database name, user and password, the authentication keys and salts, the table prefix and constants that change behavior, including those that control debugging and automatic updates.

Because it contains secrets, exposure of this file is serious. Backup copies with extensions such as .bak or .old in the web root, directory listings, or a file read flaw can reveal it. WordPress also allows it to be located one level above the web root.

Restrict its permissions, never leave copies on the server, and keep it out of repositories. If the file may have been exposed, rotate the database password and security salts, and review the database for unexpected users or content.

Where we use “wp-config.php”

CybersecurityDoes Updating WordPress Fix PHP2Shell?
A WordPress update does not fix PHP2Shell, because the flaws sit in the PHP runtime that handles requests before WordPress runs. Here is how to check your build, what to ask your host, and which separate WordPress fixes still apply.
Nov 5, 2026

The longer version

Where we use “wp-config.php”

Get the Core in your inbox.