WordPress Config Generator

Environment

Database

From your host's control panel.

Security keys

Eight random 64 character keys, made in your browser with the same characters WordPress uses.

URLs and SSL

Leave empty to keep the values stored in the database.

Force HTTPS in admin FORCE_SSL_ADMINLogins and wp-admin always over SSL.Recommended

Debugging

Turn on while building, off on a live site.

Debug mode WP_DEBUGReports PHP notices and warnings.Dev only Write to a log WP_DEBUG_LOGSaves errors to wp-content/debug.log. Show errors on screen WP_DEBUG_DISPLAYVisitors see the errors too.Dev only Unminified core files SCRIPT_DEBUGLoads the full CSS and JS of WordPress core.

Performance

Memory, revisions and scheduled tasks.

Use a real cron job DISABLE_WP_CRONStops WordPress running tasks on page loads. Needs a server cron calling wp-cron.php. Page cache drop-in WP_CACHEOnly when a caching plugin asks for it.

Updates

Hardening

Disable the file editor DISALLOW_FILE_EDITRemoves the theme and plugin code editors from wp-admin.Recommended Lock plugins and themes DISALLOW_FILE_MODSNo installs or updates from wp-admin. Also stops auto updates.

Advanced

Less common switches. Each one changes how a core feature works.

Alternate cron ALTERNATE_WP_CRONRuns scheduled tasks by redirect, for hosts where the normal cron request fails. Overwrite edited images IMAGE_EDIT_OVERWRITECrops and rotations replace the image instead of keeping a copy. Database repair page WP_ALLOW_REPAIROpens /wp-admin/maint/repair.php to anyone, no login. Turn it off right after use.Temporary

Multisite

Several sites on one WordPress. Set the network only after Tools > Network Setup.

Server rules

Added to .htaccess (Apache) or the Nginx block.

Redirect HTTP to HTTPSOne 301 redirect for every request. Block xmlrpc.phpOnly if no app or service needs XML-RPC (Jetpack and the mobile apps can). Protect wp-config.php and hidden filesRefuses direct requests to them.Recommended Turn off folder listingsNo file list when a folder has no index file. Security headersnosniff, SAMEORIGIN framing, referrer policy, HSTS. Browser cachingLong cache for images, fonts, CSS and JS.

PHP limits

Written as .user.ini (or php.ini). Some hosts set these in their panel instead.

Cleanup SQL

MySQL queries for phpMyAdmin or Adminer. They run in a safe order: content first, then the leftovers it creates.

Report (read only)

Size reportTable sizes, autoloaded options size and the 10 largest autoloaded options. Changes nothing.Start here

Posts

Post revisionsOld saved versions of posts and pages. Auto draftsEmpty drafts WordPress makes when you open the editor. Trashed postsPosts and pages already in the trash. Edit locks"Someone is editing" markers left in post meta. oEmbed cacheSaved embed HTML for videos and posts. WordPress fetches it again when needed. All draftsEvery unpublished draft of a post or page.Content

Comments

Spam and trashed commentsComments already marked spam or moved to the trash. Pending commentsComments waiting for approval.Content Pingbacks and trackbacksLink notices from other sites. Close comments and pings on all postsExisting posts stop taking comments.Content

Leftovers

Orphaned meta and term linksPost, comment and user meta, and category links, whose owner no longer exists. Unused tagsTags with no posts. Categories are kept.

Transients (cache in the options table)

Expired transientsCached values whose time has run out, with their timeout rows. Feed and browser check transientsRSS feed cache and the browser version checks of the dashboard. All transientsEvery cached value. Plugins build them again, so the first page loads are slower.

Finish

Optimize tablesGives the freed space back after large deletes.