# Rules in wp-config.php > For whoever manages the server: the lines of wp-config.php that fix how DooFiles behaves, such as read-only mode, a required second factor or the largest upload, so that nobody can change them from the settings page. Source: https://doothemes.com/docs/doofiles/guides/wp-config-rules --- ## Overview Most of what DooFiles does is set in **DooFiles › Settings**, by any administrator. When you want a rule that nobody can change from that page, put it in `wp-config.php` instead. For example: - keep DooFiles in read-only mode on your live site; - require a second factor from every administrator of the sites you manage; - keep the activity log for a year, for audits; - limit uploads to what the plan of your hosting allows. A setting fixed in `wp-config.php` shows as locked in **DooFiles › Settings**, with its value and the note *Set by … in wp-config.php.* :::info These constants need DooFiles 1.0.7 or newer, except `DOOFILES_DISABLE_2FA` and the constants of WordPress. ::: ## Add a line to wp-config.php 1. Open `wp-config.php`, in the main folder of WordPress (or one folder above it), by FTP or with the file manager of your hosting. 2. Add the line above the one that says *That's all, stop editing!* 3. Save the file and reload **DooFiles › Settings**. The row of that setting shows as locked. ```php define( 'DOOFILES_READ_ONLY', true ); /* That's all, stop editing! Happy publishing. */ ``` Copy the name exactly, in capital letters. A missing semicolon or quote breaks the whole site, so keep a copy of the file before you change it. You can also edit `wp-config.php` with DooFiles: it asks for your password and checks the syntax before saving. On a multisite network, the lines apply to every site of the network. ## The constants | Constant | Value | What it fixes | Settings row | |---|---|---|---| | `DOOFILES_READ_ONLY` | `true` or `false` | Read-only mode, only in DooFiles. The editors and updates of WordPress keep working | **Read-only mode** | | `DOOFILES_REQUIRE_2FA` | `true` or `false` | Whether every administrator needs a second factor | **Ask every administrator for a second factor** | | `DOOFILES_REAUTH_MINUTES` | 1 to 1,440 | Minutes that the password confirmation lasts, up to 24 hours | **Minutes the confirmation lasts** | | `DOOFILES_LOG_DAYS` | 1 to 3,650 | Days that the activity log is kept, up to 10 years | **Days of activity** | | `DOOFILES_MAX_UPLOAD_MB` | 1 to 102,400 | The largest upload, in MB | **Largest upload** | | `DOOFILES_DISABLE_2FA` | `true` | Turns off the second factor for everyone. Only for emergencies, such as a lost phone without recovery codes | Every row of **Second factor** | | `DISALLOW_FILE_EDIT`, `DISALLOW_FILE_MODS` | `true` | Constants of WordPress. Read-only mode in DooFiles, and they also lock the editors of WordPress (and, `DISALLOW_FILE_MODS`, installing and updating plugins and themes) | **Read-only mode** | A number out of its range is brought to the nearest limit: `DOOFILES_REAUTH_MINUTES` set to 2000 works as 1,440. A value that is not valid, such as `'yes'`, is ignored, and the setting of the page applies. ## Examples ### A live site that nobody changes by mistake Keep DooFiles in read-only mode on your live site, and make your changes on a staging copy. Unlike `DISALLOW_FILE_MODS`, WordPress can still update itself and your plugins. ```php define( 'DOOFILES_READ_ONLY', true ); ``` See [Read-only mode](https://doothemes.com/docs/doofiles/security/read-only-mode). ### A rule for the sites of an agency Require a second factor from every administrator, keep the confirmation short, and keep a year of activity: ```php define( 'DOOFILES_REQUIRE_2FA', true ); define( 'DOOFILES_REAUTH_MINUTES', 10 ); define( 'DOOFILES_LOG_DAYS', 365 ); ``` Administrators without a second factor can only browse until they turn on theirs. See [Second factor](https://doothemes.com/docs/doofiles/security/second-factor). ### The plan of a hosting Limit uploads to the size your plan allows: ```php define( 'DOOFILES_MAX_UPLOAD_MB', 500 ); ``` See [Editor and uploads](https://doothemes.com/docs/doofiles/settings/limits). ### Long work sessions If you change code for hours and the password confirmation gets in the way, make it last longer than the 120 minutes of the settings page: ```php define( 'DOOFILES_REAUTH_MINUTES', 240 ); ``` The longer the confirmation lasts, the longer someone who steals your session can change code without your password. Keep it short on sites with several administrators. See [Password confirmation](https://doothemes.com/docs/doofiles/security/password-confirmation). ## How they combine - **A constant wins over the setting of the page.** The setting stays as it was saved: when you remove the line, it applies again. - **`DISALLOW_FILE_EDIT` and `DISALLOW_FILE_MODS`** turn on read-only mode even with `DOOFILES_READ_ONLY` set to `false`. - **`DOOFILES_DISABLE_2FA`** wins over `DOOFILES_REQUIRE_2FA`. - **A developer filter** for the same setting receives the value of the constant and has the last word. See [Filters and constants](https://doothemes.com/docs/doofiles/developers/filters-and-constants). ## Keep wp-config.php safe A rule in `wp-config.php` is only as safe as the file: - Make `wp-config.php` read-only for the user that runs PHP, for example with the `440` or `400` permissions, if your hosting allows it. DooFiles then shows **View** instead of **Edit** for it, and nobody can change it through WordPress. - With `DOOFILES_READ_ONLY` on, DooFiles cannot change any file, `wp-config.php` included. - Keep a copy of the file before you change it. See [Server configuration](https://doothemes.com/docs/doofiles/guides/server-configuration#file-permissions). ## Troubleshooting | Problem | What to do | |---|---| | The row of the setting can still be changed | Check that the name is spelled exactly, in capital letters, and that the line is in the `wp-config.php` that WordPress loads, above *That's all, stop editing!* | | The site shows a critical error after editing `wp-config.php` | The line has a syntax error, such as a missing semicolon or quote. Fix it or restore your copy by FTP | | Read-only mode does not turn off with `DOOFILES_READ_ONLY` set to `false` | `DISALLOW_FILE_EDIT`, `DISALLOW_FILE_MODS` or a developer filter keeps it on. The **Read-only mode** row says which one | | An administrator can only browse | `DOOFILES_REQUIRE_2FA` is on, and they have not turned on their second factor yet | | The value is not the one I wrote | It was out of range, and DooFiles brought it to the nearest limit | Need more help? [Open a support ticket](https://doothemes.com/account/tickets/new).