wp-config.php Generator

Build a correct wp-config.php without copy-pasting from a 2014 blog post

在你的瀏覽器裡執行。什麼都不會被上傳。

Database

Database name Database user Database host Table prefixChanging this on a NEW install is fine. Changing it on an existing site requires renaming tables and rewriting two option rows — it is not a config change.

Debugging

Enable WP_DEBUGLogs PHP notices, warnings and errors. Pairs with the two options below — never enable it alone on a live site. Write errors to wp-content/debug.logRecommended. Errors go to a file instead of the page. Hide errors from visitorsSets WP_DEBUG_DISPLAY false. Without this, WP_DEBUG prints PHP errors — including your server's absolute paths — to anyone loading the page. Log database queries (SAVEQUERIES)Useful when hunting a slow page. Costs memory on every request — turn it off again afterwards.

Hardening

Disable the theme & plugin file editorDISALLOW_FILE_EDIT. If an admin account is ever compromised, the built-in editor is how a PHP backdoor gets written. There is no good reason to leave it on. Force SSL for the admin areaFORCE_SSL_ADMIN. Only enable once HTTPS actually works, or you will lock yourself out. Enable automatic core updates

Limits

WP_MEMORY_LIMIT (MB) Post revisions to keep0 disables them. Unlimited revisions are the quiet reason many wp_posts tables get enormous.

wp-config.php

Salts are generated in your browser with crypto.getRandomValues(). They are never sent anywhere — but for the record, WordPress's own api.wordpress.org salt endpoint is equally fine; it returns fresh random values over TLS.

關於wp-config.php Generator

Generate a wp-config.php with the constants you actually need — debug logging, memory limits, file-edit lockdown, upload limits, table prefix, and fresh salts. Everything is generated in your browser; nothing is sent anywhere.

相關

你可能還需要的其他工具

WP_DEBUG Configurator

Turn on the debug log without breaking your live site

Max Upload Size Fixer

Raise the upload limit — and get all three values consistent

WordPress .htaccess Generator

The rules WordPress needs, plus the hardening rules it does not ship with

FAQ

常見問題

在瀏覽器裡產生 wp-config.php 的 salts 安全嗎？

安全。這些 salts 是用 crypto.getRandomValues() 產生的，也就是瀏覽器內建、符合密碼學安全標準的亂數產生器，而且永遠不會離開你的機器。順帶一提，WordPress 官方的 api.wordpress.org salt 端點同樣安全——它會透過 TLS 回傳全新的亂數值。這是為了方便，不是什麼資安修補。

為什麼它不會問我的資料庫密碼？

因為無論一個網頁號稱多可信，你都不該把正式環境的資料庫密碼打進去。產生出來的檔案裡有一個預留位置——請在本機、在你的編輯器裡填進去。

我可以在既有的網站上更改資料表前綴嗎？

光靠編輯 wp-config.php 沒辦法。在運作中的網站上更改 $table_prefix，需要重新命名每一張資料表，並改寫 options 與 usermeta 資料表裡的兩列資料。要嘛在全新安裝時更改，要嘛就別動它。