Rules in wp-config.php

Overview

Most of what DooFiles does is set in DooFiles › Settings, by any administrator. When you want a rule that nobody can change from that page, put it in wp-config.php instead. For example:

• keep DooFiles in read-only mode on your live site;
• require a second factor from every administrator of the sites you manage;
• keep the activity log for a year, for audits;
• limit uploads to what the plan of your hosting allows.

A setting fixed in wp-config.php shows as locked in DooFiles › Settings, with its value and the note Set by … in wp-config.php.

Add a line to wp-config.php

1. Open wp-config.php, in the main folder of WordPress (or one folder above it), by FTP or with the file manager of your hosting.
2. Add the line above the one that says That's all, stop editing!
3. Save the file and reload DooFiles › Settings. The row of that setting shows as locked.

define( 'DOOFILES_READ_ONLY', true );

/* That's all, stop editing! Happy publishing. */

Copy the name exactly, in capital letters. A missing semicolon or quote breaks the whole site, so keep a copy of the file before you change it.

You can also edit wp-config.php with DooFiles: it asks for your password and checks the syntax before saving. On a multisite network, the lines apply to every site of the network.

The constants

A number out of its range is brought to the nearest limit: DOOFILES_REAUTH_MINUTES set to 2000 works as 1,440. A value that is not valid, such as 'yes', is ignored, and the setting of the page applies.

Examples

A live site that nobody changes by mistake

Keep DooFiles in read-only mode on your live site, and make your changes on a staging copy. Unlike DISALLOW_FILE_MODS, WordPress can still update itself and your plugins.

define( 'DOOFILES_READ_ONLY', true );

See Read-only mode.

A rule for the sites of an agency

Require a second factor from every administrator, keep the confirmation short, and keep a year of activity:

define( 'DOOFILES_REQUIRE_2FA', true );
define( 'DOOFILES_REAUTH_MINUTES', 10 );
define( 'DOOFILES_LOG_DAYS', 365 );

Administrators without a second factor can only browse until they turn on theirs. See Second factor.

The plan of a hosting

Limit uploads to the size your plan allows:

define( 'DOOFILES_MAX_UPLOAD_MB', 500 );

See Editor and uploads.

Long work sessions

If you change code for hours and the password confirmation gets in the way, make it last longer than the 120 minutes of the settings page:

define( 'DOOFILES_REAUTH_MINUTES', 240 );

The longer the confirmation lasts, the longer someone who steals your session can change code without your password. Keep it short on sites with several administrators. See Password confirmation.

How they combine

• A constant wins over the setting of the page. The setting stays as it was saved: when you remove the line, it applies again.
• DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS turn on read-only mode even with DOOFILES_READ_ONLY set to false.
• DOOFILES_DISABLE_2FA wins over DOOFILES_REQUIRE_2FA.
• A developer filter for the same setting receives the value of the constant and has the last word. See Filters and constants.

Keep wp-config.php safe

A rule in wp-config.php is only as safe as the file:

• Make wp-config.php read-only for the user that runs PHP, for example with the 440 or 400 permissions, if your hosting allows it. DooFiles then shows View instead of Edit for it, and nobody can change it through WordPress.
• With DOOFILES_READ_ONLY on, DooFiles cannot change any file, wp-config.php included.
• Keep a copy of the file before you change it.

See Server configuration.

Troubleshooting

Need more help? Open a support ticket.