WordPress should be configured for plugin governance, admin hardening, and update safety.
Edit wp-config.php with these essential settings:
// Database settings
define('DB_NAME', 'wordpress');
define('DB_USER', 'wordpress');
define('DB_PASSWORD', 'replace-with-strong-password');
define('DB_HOST', 'localhost');
define('DB_CHARSET', 'utf8mb4');
define('DB_COLLATE', '');
// Site URLs
define('WP_HOME', 'https://wordpress.example.com');
define('WP_SITEURL', 'https://wordpress.example.com');
// Authentication keys and salts (generate unique values)
// Get unique keys from: https://api.wordpress.org/secret-key/1.1/salt/
define('AUTH_KEY', 'unique-phrase-here');
define('SECURE_AUTH_KEY', 'unique-phrase-here');
define('LOGGED_IN_KEY', 'unique-phrase-here');
define('NONCE_KEY', 'unique-phrase-here');
define('AUTH_SALT', 'unique-phrase-here');
define('SECURE_AUTH_SALT', 'unique-phrase-here');
define('LOGGED_IN_SALT', 'unique-phrase-here');
define('NONCE_SALT', 'unique-phrase-here');
// Security settings
define('DISALLOW_FILE_EDIT', true); // Disable file editor in admin
define('WP_AUTO_UPDATE_CORE', true); // Enable automatic updates
Set correct file permissions for security:
# Directories: 755
find /var/www/html/wordpress -type d -exec chmod 755 {} \;
# Files: 644
find /var/www/html/wordpress -type f -exec chmod 644 {} \;
# wp-config.php: 400 or 440 (more restrictive)
chmod 400 /var/www/html/wordpress/wp-config.php
# Ownership (Apache)
sudo chown -R www-data:www-data /var/www/html/wordpress
wp_ during installation| Setting | Value | Notes |
|---|---|---|
| Database | MySQL 8.0+ or MariaDB 10.6+ | Use utf8mb4 charset |
| Table prefix | Custom (not wp_) |
Set during installation |
| User privileges | SELECT, INSERT, UPDATE, DELETE | Limit to required permissions only |
Back up:
Recovery test:
Squeezing every bit of performance from your Wordpress installation? Our experts help with:
Optimize your setup: office@linux-server-admin.com | Contact Us