If you run a WordPress site for your business, there’s a decent chance you’ve never opened wp-config.php. Totally normal. Most owners shouldn’t be poking around core files for fun.
But here’s the odd thing. A few tiny lines in that file can make your site harder to abuse, harder to break, and a little less annoying to manage. And they don’t require some giant enterprise security setup. Just careful edits.
This is the kind of small hardening work that gets skipped because nobody talks about it in plain English. So let’s fix that.
First, what is wp-config.php?
It’s the main configuration file for WordPress. Think of it like the control cupboard behind the wall. Your database details live there, security keys live there, and a bunch of behavior settings can live there too.
If somebody gets access to this file, you’ve got bigger problems. But if you set it up properly, you can reduce a few common risks before they become a mess.
Before touching anything, make a backup. Seriously. Download the current file first. One missing semicolon and you’ll get the lovely white screen of death. I’ve seen it happen over something as silly as curly quotes copied from a blog post.
The 5 constants worth setting
These aren’t magic. They won’t stop every attack. But they close off some sloppy, common paths attackers and bad plugins love to use.
1. DISALLOW_FILE_EDIT
This one blocks the built-in theme and plugin file editor inside wp-admin.
By default, many WordPress sites let an admin go into Appearance or Plugins and edit PHP files right from the dashboard. Convenient? Maybe. Risky? Yep.
If an attacker gets into an admin account, that editor gives them a fast way to inject malicious code. No FTP needed. No hosting panel. Just log in and paste garbage into functions.php.
define('DISALLOW_FILE_EDIT', true);For most small business sites, this should be on. No debate, honestly. If your developer really needs to edit files, they should be doing it properly through version control, SFTP, or your hosting tools.
And if your admin account setup is a bit loose, read Admin account mistakes that hand hackers the keys. That article covers the kind of login habits that quietly create big problems.
2. DISALLOW_FILE_MODS
This one is stronger. It disables installing, updating, and deleting plugins, themes, and core files from the WordPress admin area.
define('DISALLOW_FILE_MODS', true);Now, this is not for everyone.
If you manage your own updates inside wp-admin, this will annoy you immediately. But for businesses with a developer, agency, or locked-down workflow, it’s a smart move. It stops someone with dashboard access from installing random plugins at 11:40 p.m. because they wanted a popup, a slider, a review widget, and who knows what else.
That stuff happens alot more than people admit.
It’s also useful if you want tighter change control. If your staff log in to edit content but should never be messing with site functionality, this helps draw the line.
If you still want updates handled for you, a proper WordPress maintenance setup makes a lot more sense than giving every admin a free hand in the dashboard.
3. FORCE_SSL_ADMIN
This tells WordPress to force HTTPS for admin pages and logins.
define('FORCE_SSL_ADMIN', true);If your site already uses SSL – and it should – this makes sure admin traffic stays encrypted. Login details, cookies, session data. All the bits you don’t want floating around in plain text.
Most modern hosts already push HTTPS pretty well, so this can feel redundant. Still worth setting. Belt and braces.
Especially if your site has had a weird hosting history, old redirects, or bits of the admin loading over the wrong protocol. Small business sites often get rebuilt, patched, migrated, and half-cleaned over the years. Things drift.
If your SSL setup is shaky, fix that first. Don’t force this constant on a broken HTTPS setup and then wonder why wp-admin acts funny.
4. WP_POST_REVISIONS
This one isn’t pure security, but it matters more than people think.
define('WP_POST_REVISIONS', 5);WordPress stores revisions every time you save content. Helpful, yes. But left unlimited, revisions can bloat your database over time, especially on sites where three people keep editing service pages, product text, opening hours, staff bios, and blog drafts.
A bloated database can slow backups, complicate cleanups, and make recovery work more annoying after an incident. Not dramatic on day one. Annoying six months later.
Setting a sensible limit like 5 or 10 keeps things tidy without taking away the safety net.
This fits the same general idea as avoiding plugin junk and dashboard clutter. If your site is carrying too much baggage already, this article on The Hidden Danger of Abandoned Plugins on Your WordPress Site is worth a read too.
5. AUTOSAVE_INTERVAL
Another small one. Another useful one.
define('AUTOSAVE_INTERVAL', 300);The number is in seconds. So 300 means WordPress autosaves every 5 minutes instead of the default 60 seconds.
Why bother? Because constant autosaving can create extra revisions, extra database writes, and extra clutter on busy editing sites. It’s not some giant security lock, sure, but reducing unnecessary churn makes the site cleaner and calmer. Less background noise. Fewer weird revision piles.
If you’re a solo business owner editing one blog post a month, this won’t change your life. But if your assistant, your marketing person, and your developer all poke around the site, stretching the interval a bit is reasonable.
Where to put these lines
Add them to wp-config.php above the line that says:
/* That's all, stop editing! Happy publishing. */Simple rule: put custom constants above that line, save the file, then test the site right away.
Check these pages after editing:
- Homepage
- WP admin login page
- Dashboard
- A plugin screen
- A page edit screen
If something breaks, restore the backup and try again slower. No shame in that.
A few mistakes to avoid
This is where people trip up. Not on the idea. On the typing.
- Don’t add constants twice. If a line already exists, edit it instead of pasting a duplicate.
- Don’t use smart quotes copied from email or Google Docs.
- Don’t test on Friday night unless you enjoy stress.
- Don’t set
DISALLOW_FILE_MODSif you rely on dashboard updates and don’t have another plan.
And please don’t go adding random snippets from ten different forums. That’s how a clean config file turns into spaghetti.
Should every small business owner do this?
Maybe. But not every constant here belongs on every site.
If you want the short version, here’s my take:
Definitely set: DISALLOW_FILE_EDIT, FORCE_SSL_ADMIN
Usually set: WP_POST_REVISIONS, AUTOSAVE_INTERVAL
Set carefully: DISALLOW_FILE_MODS
If your site has already been hacked before, or you suspect file changes happened through the dashboard, don’t just harden it and hope for the best. Get it cleaned properly first. That’s what site cleaning is for.
This is hardening, not a full security plan
These five constants are good housekeeping. They reduce avoidable risk. They do not replace updates, backups, malware scanning, login protection, or basic monitoring.
Still, they’re worth doing because they live at the config level. Quiet. Boring. Effective.
And honestly, that’s the best kind of website security for a small business. The kind that doesn’t need your attention every day, just a little care once, set up properly, then checked now and then.
Small tweaks. Real payoff. That’s the game.