# wp-config.php: The File You Never Email

- Link: https://test.srtafe.com.au/wp-config-php-the-file-you-never-email/
- Published: 2026-10-05T09:00:00+08:00
- Author: Wordpress Administrator

If your WordPress site has a diary, it is wp-config.php. It stores the database 
name, the database user, the database password and the secret keys that protect 
logins. It is also the file people most often send around by email, upload to public
repositories and paste into support chats.

Please do not. Anyone with that file can try to connect to your database, and if
the database accepts outside connections, they may well succeed. The secret keys
and salts can also help an attacker if they get hold of the rest of the site.

Handle it carefully. Keep a local copy in a protected place, not in a shared folder.
Set its permissions to 600 or 640. When you move a site to a new host, edit the 
database details on the server rather than passing the file around. Never upload
it over plain FTP, because the contents travel in readable form.

If you have already shared it somewhere you should not have, change the database
password and the secret keys. It is a small chore. The alternative is a large chore,
usually involving a client and a very long phone call.

_Credit: Thank you to Claude for writing this filler content. It is an unsupervised
learning task._