wp-config.php Generator
The file everyone copies from the last project. Pick an environment and it writes the debug, cache and security constants that suit it — and warns about the ones that do not.
<?php // Generated with WP CodeKit — powered by GrowQuest (https://growquest.io). /** * WordPress configuration — production. * * Everything must be defined before the require at the bottom. */ // ** Database ** // define( 'DB_NAME', 'acme_wp' ); define( 'DB_USER', 'acme_wp' ); define( 'DB_PASSWORD', '' ); define( 'DB_HOST', 'localhost' ); define( 'DB_CHARSET', 'utf8mb4' ); define( 'DB_COLLATE', '' ); $table_prefix = 'wp_'; // ** Environment ** // define( 'WP_ENVIRONMENT_TYPE', 'production' ); // ** Content and updates ** // define( 'DISALLOW_FILE_EDIT', true ); define( 'DISALLOW_FILE_MODS', true ); define( 'WP_AUTO_UPDATE_CORE', 'minor' ); define( 'WP_POST_REVISIONS', 5 ); define( 'EMPTY_TRASH_DAYS', 14 ); // ** Performance and cron ** // define( 'WP_CACHE', true ); define( 'DISABLE_WP_CRON', true ); define( 'WP_CRON_LOCK_TIMEOUT', 300 ); // ** Security and URLs ** // define( 'FORCE_SSL_ADMIN', true ); define( 'WP_MEMORY_LIMIT', '256M' ); define( 'WP_MAX_MEMORY_LIMIT', '512M' ); // ** Authentication salts — unique to this site ** // define( 'AUTH_KEY', 'f#CQJBOpPy*o:.x7v~IErP}~./8r}m0MVA.At?z`&!f*A,-Q%ApW]VF|tY.2P{w!' ); define( 'SECURE_AUTH_KEY', '+U{=oC^Oa@wmGD$EA{Wl(cb3Bv0)WNt/Ya}(c)~JaT&^L?o%>#!eNQFrYT*3-Wsx' ); define( 'LOGGED_IN_KEY', 'oL-_7eJQ7hR^Ymb]9N]~Wkzmj)R@EpA<&+(/,<g#yL:Wn^E2jc!aa^Knd,e%m^yf' ); define( 'NONCE_KEY', 'Eb4K~L0o3G-/JhuJed&?wO=Juwz(h=E~~*i$#K^@h>~hKg>;el+,98S]9$+SCyOt' ); define( 'AUTH_SALT', '8P!2`vus,^|IKsD*J~<_g#]ISF8&].sNJRm|S@g`=/(>elnjrb*huWOPt#~j%qk5' ); define( 'SECURE_AUTH_SALT', 'zN5$$`D>aWipGJ7Uoy?qqfW|^tngNFpp;PPgr}z=e#B6dMc7-,_2!p11^SaAvUUa' ); define( 'LOGGED_IN_SALT', 'f2TX?N,Ru+r4s<B:S9S]3m#>63e5$=vc;j6vH?S~dq$)n:FWziMiA[eL_4[5+_Mg' ); define( 'NONCE_SALT', 'n4%P_%oH_%F[y-,$>`[d{w_ig6EC[+)s8FJpL(Jph^K+-3UTG>GKOteZLPevp)`%' ); // ** Absolute path and bootstrap ** // if ( ! defined( 'ABSPATH' ) ) { define( 'ABSPATH', __DIR__ . '/' ); } require_once ABSPATH . 'wp-settings.php';
About this generator
wp-config.php Generator Online
The file everyone copies from the last project, written properly instead. This wp-config generator asks which environment you are building for, then emits the database block, $table_prefix, WP_ENVIRONMENT_TYPE, eight fresh salts and the debug, cache and security constants that suit that environment — with a warning for every one that does not.
Salts are generated in your browser with crypto.getRandomValues(), so the eight keys in the output are unique to you and were never transmitted anywhere. Switch to the getenv() output mode and the same file becomes safe to commit, because the credentials move to the environment instead.
Reviewed Output tested on WordPress 6.8 · PHP 8.3
Why a generated wp-config.php beats the one you inherited
Most config files on live sites are a development file that was never tidied up. WP_DEBUG_DISPLAY still prints paths to visitors, SAVEQUERIES still holds every query in memory, and the salts are the ones from the tutorial the site was built from. Each of those is a specific, checkable mistake, so the generator checks for them.
Four environment presets
Local, development, staging and production each load a different constant set, and each writes WP_ENVIRONMENT_TYPE so wp_get_environment_type() reports the truth — the flag plugins read before deciding whether to email real customers.
Debug settings that cannot leak
Turn on WP_DEBUG and WP_DEBUG_LOG without display, and the generator also writes WP_DEBUG_DISPLAY false plus @ini_set( 'display_errors', 0 ) — the pairing that keeps errors in debug.log and off the page.
Production mistakes flagged as errors
WP_DEBUG_DISPLAY or SAVEQUERIES on a live site is an error with a one-click fix, SCRIPT_DEBUG is a warning, and a missing DISALLOW_FILE_EDIT or FORCE_SSL_ADMIN is called out for what it is: an admin account away from arbitrary PHP.
Eight salts, generated locally
All eight keys and salts are 64 random characters from crypto.getRandomValues(). Anything shorter than 60 characters, or missing, is an error with a regenerate button beside it.
Credentials out of the repository
The getenv() mode reads DB_NAME, DB_USER, DB_PASSWORD and DB_HOST from the environment with a localhost fallback, and hard-coded credentials in a staging or production config raise a warning that offers the switch.
The small things that bite
A $table_prefix without a trailing underscore is an error, a memory limit that is not in 256M form is rejected, and FORCE_SSL_ADMIN on a local site with no certificate is flagged before it locks you out of the admin.
How does the wp-config.php generator work?
Four steps, and nothing you type is sent anywhere — the database password and the salts exist only in this browser tab.
- 01
Choose the environment
Local, development, staging or production. The choice loads a sensible preset of constants and sets
WP_ENVIRONMENT_TYPEto match. - 02
Fill in the site details
Database name, user, password and host, the table prefix, the site URL and the memory limit. Or leave them and switch the output mode to read from environment variables.
- 03
Tune the constants
Toggle anything across Debugging, Content and updates, Performance and cron, and Security and URLs. Each toggle shows the value that will be written and warns when it is wrong for the environment you picked.
- 04
Generate salts and export
Press New salts for a fresh set, clear the Checks tab, then copy or download
wp-config.php.
Worked example — the constants block from a production preset
This is the middle of the generated file: everything above it is the database block and $table_prefix, everything below is the eight salts and the require_once ABSPATH . 'wp-settings.php'; line.
// ** Environment ** //
define( 'WP_ENVIRONMENT_TYPE', 'production' );
// ** Content and updates ** //
define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );
define( 'WP_AUTO_UPDATE_CORE', 'minor' );
define( 'WP_POST_REVISIONS', 5 );
define( 'EMPTY_TRASH_DAYS', 14 );
// ** Performance and cron ** //
define( 'WP_CACHE', true );
define( 'DISABLE_WP_CRON', true );
define( 'WP_CRON_LOCK_TIMEOUT', 300 );
// ** Security and URLs ** //
define( 'FORCE_SSL_ADMIN', true );
define( 'WP_MEMORY_LIMIT', '256M' );
define( 'WP_MAX_MEMORY_LIMIT', '512M' );DISABLE_WP_CRON is only half of a fix: it stops WP-Cron running on page loads, so a real crontab has to hit wp-cron.php (or run wp cron event run --due-now) or nothing scheduled runs at all. The generator says so in the Checks tab.
wp-config.php — frequently asked questions
What developers ask most often when configuring a WordPress site for a new environment.
How do I enable WP_DEBUG without showing errors to visitors?
Set WP_DEBUG to true, WP_DEBUG_LOG to true and WP_DEBUG_DISPLAY to false, then add @ini_set( 'display_errors', 0 ) because some hosts override the constant. Errors are then written to wp-content/debug.log and nothing is printed into the page. Move the log outside the web root, or deny it in the server config, since it can contain paths and query fragments.
What happens if I change the WordPress salts?
Every existing login cookie and nonce becomes invalid immediately, so all users — including you — are logged out and have to sign in again. Nothing else is affected: no content, no settings, no passwords. That is exactly why regenerating the salts is the first step after a suspected compromise.
Do the constants have to go before wp-settings.php?
Yes. The last line of wp-config.php is require_once ABSPATH . 'wp-settings.php';, and that is where WordPress boots. A define() placed after it is ignored silently, which is the usual reason a debug or memory constant "does not work". Put everything above that line.
Should I change the wp_ table prefix?
Changing it on a new install costs nothing and blocks the laziest automated attacks that assume wp_posts. It is not a security control on its own, and changing it on an existing site means renaming every table plus rewriting serialised option and usermeta keys, which is far more risk than the benefit. Whatever you choose, the prefix must end with an underscore or the table names run together.
Is it safe to commit wp-config.php to git?
Not with the credentials and salts inline. Either keep the file out of version control entirely, or use the environment-variable output so the file contains getenv( 'DB_PASSWORD' ) rather than the password itself. Either way the file should sit outside the web root or be denied by the server — it holds the keys to the whole site.
What does WP_ENVIRONMENT_TYPE actually do?
Since WordPress 5.5 it records which environment the site is: local, development, staging or production. Core uses it to decide whether to auto-update, and any plugin can call wp_get_environment_type() to branch on it — which is how you stop a staging copy sending real order emails. It defaults to production when unset, so setting it on non-production sites is the part that matters.
Where do I paste the code from the wp-config.php generator?
These are constants for wp-config.php, and they must sit **above** the line that reads /* That's all, stop editing! */ — anything after it is ignored. Never paste them into functions.php.
Can I use the generated code in client work or a commercial plugin?
Yes. The output is ordinary WordPress API calls that you configured — there is no licence attached to it and no attribution required. Use it in client sites, commercial plugins and themes, or products you sell. The generated file carries a short credit comment you are free to delete.
The other Core generators in the library, plus the WordPress tools most often used alongside this one.