🧂 Fresh salt generator
Eight new 64-character keys, generated in your browser with the Web Crypto API. Safe to paste straight into wp-config.php, replacing your existing key block. Regenerating logs everyone out, which is a fast way to end any hijacked sessions.
🔎 What it checks
Every finding is ranked by severity and comes with the exact line to add or change. The checks, roughly from most to least urgent:
- Security keys and salts: all eight present, none still holding the sample placeholder, none duplicated, none suspiciously short.
- Debug exposure:
WP_DEBUGandWP_DEBUG_DISPLAY, plus a forcedini_set('display_errors', 1), any of which can print server paths and errors to visitors. - Database credentials: an empty or default password (checked locally, never shown or sent).
- File editing:
DISALLOW_FILE_EDITand the broaderDISALLOW_FILE_MODS, which stop dashboard file editing when their runtime value is enabled. - Transport:
FORCE_SSL_ADMINfor encrypted logins. - Table prefix: whether it is still the default
wp_. - Hardening and performance extras: automatic updates, debug log location, environment type, post revisions, memory limit.
🔒 How the privacy boundary works
wp-config.php contains your database password, so where you paste it matters. This published build is a static page. The audit runs in your browser, stores nothing, and does not send the pasted text anywhere. Its Content Security Policy blocks connections and limits images to this origin or embedded data. You can inspect the small engine or use the tool locally. You can also redact the four DB_ lines; the remaining checks still work.
💬 Frequently asked questions
On a new install, yes, pick something non-default. On a live site, changing it means renaming database tables and updating references, which is risky to do casually. The audit flags wp_ as low severity for exactly this reason: it is obscurity, not a real defense, so do not break a working site chasing it.
Rotate them when you suspect a compromise or need to invalidate every logged-in session. Routine calendar-based rotation is not required. Changing the salts signs everyone out immediately.
No. This audits one file. Real security also depends on updates, strong passwords, hosting, plugins, and more. A clean wp-config.php removes a set of common, avoidable mistakes; it is a floor, not a ceiling.
Yes. docs/config.js is a dependency-free ES module exposing parseConfig, audit, and generateSalts. MIT licensed.
🌱 Why I built this
Every WordPress cleanup I have done started the same way: open wp-config.php and read the same dozen lines. I kept the checklist in my head, and heads forget things. This page is that checklist made permanent, and it reads the file without the file ever leaving your machine.