WordPress wp-config.php generator

This free wp-config.php generator brings the WordPress configuration options into one form. Start with your database connection, then review security, site addresses, content behaviour and optional integrations. Each setting has an explanation and a recommendation you can weigh up for your own site.

Know the limits

Your settings stay in this browser and are never sent to this site. The generator does not choose an operating system or server size, and it cannot connect to your database or check a live WordPress site. The downloaded file holds secrets, so store it privately. An existing site must keep its real table prefix, and changing the authentication keys and salts signs everyone out.

Moving a site to a new address

Use a migration process that is backed up and can be reversed. Test the change first, use tools that keep serialised data intact, and remove temporary migration helpers afterwards. Run these commands in your server terminal, not in wp-config.php:

wp option update siteurl 'https://new-domain.example'
wp option update home 'https://new-domain.example'
wp search-replace 'https://old-domain.example' 'https://new-domain.example' --all-tables --precise --dry-run

• Address options: the two option commands change the stored home and siteurl values. A WP_HOME or WP_SITEURL set in wp-config.php still overrides them, so update both places the same way.
• Search and replace: WP-CLI search-replace updates old addresses and keeps serialised values intact. Read the dry run first, back up the database, then run it again without --dry-run. --all-tables can reach other sites that share the database, so choose the table scope with care.
• Temporary helpers: an update_option() call in a theme or plugin changes the addresses every time it runs. Prefer a one-time command, and if you do use code, remove it straight after the change. Never paste it into wp-config.php.
• Browser-based tools: search-and-replace plugins and scripts give you a screen for the same database edits. Use a backup, a precise scope and a dry run where they offer one, and delete standalone scripts from the server after use.

Read the WP-CLI search-replace guide before you change a live database.

Settings that belong in a plugin, not wp-config.php

Keep the normal WordPress start-up and the integrations your site needs. The filters below run after WordPress loads, so they go in a plugin or your theme's functions.php. Test the editor and anything that uses the WordPress APIs before you switch features off.

// Turn off application passwords (WP_DISABLE_APPLICATION_PASSWORDS is not a core setting).
add_filter( 'wp_is_application_passwords_available', '__return_false' );

// Stop loading block patterns from WordPress.org.
add_filter( 'should_load_remote_block_patterns', '__return_false' );

// Turn off XML-RPC methods that need a login (this does not block the endpoint itself).
add_filter( 'xmlrpc_enabled', '__return_false' );

• Application passwords: turn them off only when no connected app needs them, and review your connected apps first. See the WordPress reference for application passwords.
• Remote block patterns: this changes which patterns the editor offers. It does not stop every outgoing request or change page caching.
• XML-RPC: the filter turns off XML-RPC methods that need a login. It does not block every method or the xmlrpc.php file, and blocking the file on the server needs its own checks for remote publishing tools. See the xmlrpc_enabled filter.
• REST API: avoid a blanket block of the REST API for visitors who are not signed in. Public content, the editor, forms and integrations can all depend on it, so plan any restriction route by route and test each workflow.