wp-config.php Generator (Secret Keys, Salts & Settings)
Fill in the database and pick your settings: every line is checked and explained.
Try before you buy.
- Free preview: the whole wp-config.php and salts block with the eight keys and salts masked, every check, and what each line does.
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
wp-config.php
In the free preview the eight keys and salts show as •••; everything else is the real file.
Upload it to the folder that holds wp-settings.php, then give it the permission 400 or 440.
Checks
What each line does
| Setting | Value | What it does |
|---|
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the wp-config.php Generator (Secret Keys, Salts & Settings)
wp-config.php is the first file WordPress reads: the database it connects to, the secret keys and salts that sign every login cookie, the table prefix, and the switches for debugging, memory, HTTPS, updates and multisite. This generator writes a complete one from a short form, in the layout of WordPress’s own wp-config-sample.php, with a one-line comment above each setting if you want them.
The eight keys and salts are made in your browser with the Web Crypto API: 64 characters each from the same 92 characters WordPress’s secret-key service uses, so they can be pasted straight in. Every value is checked as you type — a malformed DB_HOST, a table prefix WordPress refuses, a site address with a trailing slash, a collation of the wrong character set — and the page warns about settings with side effects, such as DISALLOW_FILE_MODS also stopping security updates or a public debug.log. A separate salts only block is ready for rotating the keys after a break-in or a move.
Nothing you type leaves the page, and the password and keys are never stored. Without a pass the result is a free preview: the whole file and the salts block with the keys and salts masked, every check and the explanation of each line; copying and downloading the file unlock with a Pro pass.
How to use it
- Enter the database name, user and host your hosting panel shows. Type the password only if you want it in the file; otherwise the file keeps WordPress’s placeholder
password_herefor you to replace on the server. - Keep the random table prefix for a new site, or type the prefix the existing tables use.
- Pick the settings you need: debugging (logged to a file, never shown to visitors), memory limits, the file editor and HTTPS, updates, revisions and trash, the page cache and multisite. Each one says what it does.
- Read the checks under the file and fix every error. Warnings name side effects you may want to know about.
- With a Pro pass, download wp-config.php (or copy it) and upload it to the folder that holds wp-settings.php; in the free preview the keys and salts stay masked.
- To rotate the keys of a running site, open Salts only and paste the eight lines over the old ones; everyone will have to log in again.
Examples
Database host: mysql.example.com:3307, or localhost:/var/run/mysqld/mysqld.sock
define( 'DB_HOST', 'mysql.example.com:3307' );
WordPress reads a port or a socket path after the colon; anything else after it is an error.
Debugging on · log to /home/site/logs/wp-errors.log · do not display
define( 'WP_DEBUG', true ); define( 'WP_DEBUG_LOG', '/home/site/logs/wp-errors.log' ); define( 'WP_DEBUG_DISPLAY', false ); @ini_set( 'display_errors', 0 );
A path outside the web root, because wp-content/debug.log can be downloaded by anyone unless the server blocks it.
Force HTTPS for logins · HTTPS ends at a proxy
define( 'FORCE_SSL_ADMIN', true );
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && false !== strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) ) {
$_SERVER['HTTPS'] = 'on';
}Without the second part WordPress sees plain HTTP behind the proxy and the dashboard redirects in a loop.
Common uses
- Setting up WordPress by hand on a VPS, in Docker or on hosting without a one-click installer.
- Rotating the keys and salts after a break-in, a leaked backup or a departing administrator: every stolen login cookie stops working.
- Turning on error logging to find a white screen or a plugin conflict, without showing errors to visitors.
- Locking down a client site: no file editor, HTTPS for logins, a sensible number of revisions.
- Preparing the wp-config.php settings for a WordPress network (multisite) after Network Setup.
The keys and salts, and when to change them
WordPress signs its login cookies with AUTH_KEY, SECURE_AUTH_KEY and LOGGED_IN_KEY, and its one-time form tokens with NONCE_KEY; each has a matching salt. Long random values make a cookie impossible to forge. Changing them makes every existing login cookie invalid at once, so everyone, including an intruder with a stolen cookie, has to log in again — which is why they are the first thing to change after a break-in. They are not passwords you need to remember, and changing them does not reset anyone’s password.
The generator draws each character with crypto.getRandomValues() and rejection sampling, so all 92 characters are equally likely, and the set never contains a quote or a backslash that would break the PHP string.
Settings with side effects
DISALLOW_FILE_EDITremoves the plugin and theme editor from the dashboard: a stolen admin login can no longer rewrite PHP files there. It is on by default here.DISALLOW_FILE_MODSgoes further: no installing or updating plugins and themes from the dashboard, and it also turns off automatic updates, security releases included. Use it only when updates arrive by deployment, WP-CLI or your host.WP_DEBUGwithWP_DEBUG_DISPLAYon shows PHP errors to every visitor, including file paths. Log to a file outside the web root instead.EMPTY_TRASH_DAYS0 turns the trash off: deleting is permanent.WP_CACHEonly loadsadvanced-cache.php, which a caching plugin provides; it caches nothing on its own.WP_MEMORY_LIMITcan only raise PHP’s memory limit, and only where the host lets PHP change it.
Multisite in two steps
A network is made in two passes. First WP_ALLOW_MULTISITE adds Tools → Network Setup to the dashboard; that screen creates the network’s tables and asks for sub-domains (shop.example.com) or sub-directories (example.com/shop/). Only then do MULTISITE, SUBDOMAIN_INSTALL, DOMAIN_CURRENT_SITE, PATH_CURRENT_SITE, SITE_ID_CURRENT_SITE and BLOG_ID_CURRENT_SITE go in, together with the new rewrite rules the screen shows. A network cannot use a port other than 80 or 443, sub-domain networks need a real domain (not localhost or an IP address) and a wildcard DNS record for sites made on demand, and sub-directories are offered only for new installs. The server’s rewrite rules belong in the .htaccess generator, not in this file.
Sources
- wp-config.php reference — database settings, keys and table prefix
- Editing wp-config.php — every advanced constant and its default
- Debugging in WordPress — logging and display settings
- HTTPS for WordPress — the reverse-proxy setting
- Create a network — multisite steps
- Hardening WordPress — protecting wp-config.php
Limitations
- The generator does not read or connect to your database: it cannot tell whether the name, user, password or host are right. WordPress says “Error establishing a database connection” when one of them is wrong.
- Changing the table prefix of an existing site in this file does not rename its tables; the prefix must match the tables that exist.
- Constants a plugin or host asks for (an object cache’s settings, a CDN’s keys) are not in the form: add them between the “custom values” line and the “stop editing” line.
- DB_CHARSET and DB_COLLATE only apply to tables WordPress creates; they never convert existing ones.
Privacy
On this device: nothing is sent
Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.
Frequently asked questions
What do I get without a pass?
Without a pass, wp-config.php Generator (Secret Keys, Salts & Settings) shows the whole wp-config.php and salts block with the eight keys and salts masked, every check, and what each line does. Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Where does wp-config.php go, and who should be able to read it?
In the folder that holds wp-settings.php (usually the site’s root), or one folder above it, where WordPress also looks. Give it the permission 400 or 440 so only you and the web server can read it, and never commit it with the real password and keys.
Will new keys and salts log people out or break anything?
They log everyone out, and that is all: cookies signed with the old keys stop working, so each user logs in again with their usual password. Passwords, posts and settings are not touched.
Is it safe to type my database password here?
The password and the keys stay in this page’s memory: they are not sent anywhere and not saved in the browser (only the non-secret choices are remembered). You can also leave the password empty and replace password_here on the server.
Why are the keys made here instead of by WordPress’s secret-key service?
Both work, and use the same characters. Made in the browser, the keys never cross the network at all; the service sends them to you over HTTPS. Either way, use each set for one site only.
What does the free preview show?
The whole wp-config.php and the salts block, with the eight keys and salts masked, every check and the explanation of each line. Copying and downloading the file, with the keys in it, need a Pro pass.
Should I change the table prefix from wp_?
For a new site a random prefix costs nothing and keeps several installs apart in one database. It is not a strong security measure on its own, and for an existing site the prefix must stay what the tables use.