The wp-config.php file controls how WordPress connects to your database and how it behaves. Fill in your details, choose the settings you need, and the tool builds a complete file with brand-new security salts. Everything is created in your browser. Nothing is sent to our server.

wp-config.php Generator

Build a wp-config.php file with fresh security salts, debug settings, memory limits and hardening options.

Input Section

Database name

Database user

Database password

Database host

Table prefix

Charset

WP_HOME (optional)

WP_SITEURL (optional)

Environment type

Post revisions

Core auto-updates

Memory limit

Max memory (admin)

Autosave interval (seconds)

Empty trash after (days)

Enable WP_DEBUG Write errors to debug.log (with debug on) SCRIPT_DEBUG (unminified core scripts) Disable theme and plugin file editor Disable all plugin and theme installs and updates Force SSL for admin Enable WP_CACHE Disable WP-Cron (use a server cron job)

Result Section

Insights / Tips

Everything runs in your browser. Still, avoid typing a live production password on a shared computer.
Keep wp-config.php outside the public web root or deny access to it in .htaccess.
Run debug mode on staging, and turn off WP_DEBUG_DISPLAY on any public site.

Internal Links

Nonce and Security Guard Generator .htaccess Generator WP-Cron Scheduler Builder

What you can set

Database: name, user, password, host, charset and table prefix.
Security salts: eight unique keys, created in your browser each time you generate.
Debugging: WP_DEBUG, WP_DEBUG_LOG, WP_DEBUG_DISPLAY and SCRIPT_DEBUG.
Hardening: disable the theme and plugin editor, block all file changes, and force SSL for the admin area.
Performance: memory limit, admin memory limit, post revisions, autosave interval and trash cleanup.
Updates and cron: control core auto-updates or turn off WP-Cron to use a server cron job.
Site URLs and environment: set WP_HOME, WP_SITEURL and WP_ENVIRONMENT_TYPE.

How to use the wp-config.php generator

Enter your database name, user and password. Your host can give you these.
Choose the settings you want.
Click Generate wp-config.php.
Download the file, or copy it into a new file named wp-config.php.
Back up your current wp-config.php, then upload the new one to your WordPress root folder.
Visit your site and the admin dashboard to confirm everything loads.

Safety tips

Back up first. A wrong database value will show the “Error establishing a database connection” page.
Keep the file private. Never post it publicly or commit real passwords to a public repository.
Changing salts logs everyone out. That is expected, and a good idea after a security incident.
Do not change the table prefix on an existing site unless you also rename the database tables.
Turn off WP_DEBUG_DISPLAY on live sites so errors are never shown to visitors.

Frequently asked questions

Where is wp-config.php located?

In the root folder of your WordPress install, next to wp-content. It can also sit one folder above the root.

What are WordPress salts?

They are random strings that make the login cookies stored in visitors’ browsers harder to crack. Each site should have its own.

Is it safe to type my database password here?

The tool works in your browser and does not send your data anywhere. Still, avoid entering real production passwords on a shared or public computer.

What does DISALLOW_FILE_EDIT do?

It removes the theme and plugin code editor from the dashboard, so an attacker with admin access cannot edit PHP files there.

What is the difference between DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS?

The first only removes the code editor. The second also blocks installing and updating plugins, themes and core from the dashboard.

How much memory should I set?

256M is a common value for the front end and 512M for the admin area. Your host may cap the limit.