Useful wp-config.php settings for WordPress
The settings that live in wp-config.php, not in the admin panel, and the ones worth knowing.
From the archive: first published on mohamedsharaf.net in May 2011. Rewritten and checked in 2026; some details may be out of date.
Most WordPress settings are in the admin panel, but some only exist in wp-config.php. These are the ones I find myself using. Add them above the line that says “That’s all, stop editing!”.
// Debugging: log errors to wp-content/debug.log, never show them to visitors
define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
// Keep at most 5 revisions per post
define( 'WP_POST_REVISIONS', 5 );
// Autosave every 2 minutes instead of every 60 seconds
define( 'AUTOSAVE_INTERVAL', 120 );
// Empty the trash after 7 days
define( 'EMPTY_TRASH_DAYS', 7 );
// Turn off the theme and plugin file editor in the dashboard
define( 'DISALLOW_FILE_EDIT', true );
// Give WordPress more memory
define( 'WP_MEMORY_LIMIT', '256M' );
// Always use HTTPS for the login page and the dashboard
define( 'FORCE_SSL_ADMIN', true );Two of these are security wins in one line each: DISALLOW_FILE_EDIT means a stolen admin password can’t be used to edit PHP files from the browser, and WP_DEBUG_DISPLAY set to false keeps error details away from visitors.