Files, wp-config and the database

Module 1: How WordPress works · Reading time: 9 minutes

Learning objective: After this lesson you'll recognise WordPress's folders, the settings in wp-config.php and the main database tables, and you'll know what to find where.

Key concepts: wp-admin, wp-includes, wp-content (themes, plugins, uploads, mu-plugins), wp-config.php (DB_*, table_prefix, keys and salts, WP_DEBUG), .htaccess, wp_options (siteurl, home), wp_posts, wp_users

Two halves: files and database

A WordPress website always consists of two parts that belong together:

1. Files in your domain's web directory (with DirectAdmin: domains/example.com/public_html): the WordPress code, your themes, your plugins and everything you upload.
2. A database: all your text, Pages, menus, settings, users and Comments.

This distinction matters for backups and migrations. A backup with only the files is missing all your text. A backup with only the database is missing all your photos. You need both (lesson 8.1).

The folders

Open your web directory in File Manager or with an FTP program, and you'll see roughly this:

public_html/
├── wp-admin/          the Dashboard (core)
├── wp-includes/       the rest of WordPress (core)
├── wp-content/        everything that's yours
│   ├── themes/        the themes
│   ├── plugins/       the plugins
│   ├── uploads/       your media, by year and month: uploads/2026/11/
│   ├── mu-plugins/    "must use" plugins (if present)
│   ├── languages/     translations
│   └── upgrade/       temporary folder for updates
├── .htaccess          rules for the web server
├── index.php          the starting point of every page request
├── wp-config.php      the settings for this installation
├── wp-login.php       the login page
├── xmlrpc.php         an old interface for apps (lesson 7.3)
└── ...                other core wp-*.php files

The rule of thumb: wp-admin, wp-includes and the separate wp-*.php files belong to WordPress. These get overwritten with every update. Never put anything of your own there and never change anything in them.

wp-content is yours. A WordPress update leaves this folder alone (apart from the default themes and plugins that come bundled with it). This is where your themes, plugins and uploads go. A few things worth knowing:

• uploads grows the fastest. WordPress stores every photo you upload in several sizes (lesson 4.4). A website with years of news content can have gigabytes of uploads.
• mu-plugins (must use) are plugins that are always active and that you can't switch off in the Dashboard. Some hosts and plugins use them. Intruders also like to hide things there (lesson 7.5). If you don't recognise a file there, find out where it came from.
• A deleted plugin disappears from plugins. A deactivated plugin stays put, with all its code (lesson 5.4).

wp-config.php: the settings

wp-config.php is the first thing WordPress loads. It contains the details WordPress uses to reach the database, plus a handful of settings for the whole installation. A shortened version:

define( 'DB_NAME', 'gebruiker_wp1' );
define( 'DB_USER', 'gebruiker_wp1' );
define( 'DB_PASSWORD', 'een-lang-willekeurig-wachtwoord' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );

define( 'AUTH_KEY',         'long random text' );
define( 'SECURE_AUTH_KEY',  'long random text' );
define( 'LOGGED_IN_KEY',    'long random text' );
define( 'NONCE_KEY',        'long random text' );
define( 'AUTH_SALT',        'long random text' );
define( 'SECURE_AUTH_SALT', 'long random text' );
define( 'LOGGED_IN_SALT',   'long random text' );
define( 'NONCE_SALT',       'long random text' );

$table_prefix = 'wp_';

define( 'WP_DEBUG', false );

/* That's all, stop editing! */
require_once ABSPATH . 'wp-settings.php';

What it means:

• DB_NAME, DB_USER, DB_PASSWORD, DB_HOST: which database, user and password WordPress connects with, and on which server. If one of these is wrong, you'll see "Error establishing a database connection". This often happens after a migration or after a database password change.
• The keys and salts (the eight lines with KEY and SALT): random text that WordPress uses to sign login cookies. Anyone who knows them could, in theory, create a valid login cookie. Replacing them logs everyone out. That's exactly what you do after a hack (lesson 7.5). You can get new values from https://api.wordpress.org/secret-key/1.1/salt/.
• $table_prefix: the prefix for all table names, usually wp_. This lets several installations share one database. Choosing a different prefix isn't real security, but it isn't harmful either.
• WP_DEBUG: switches on error messages. On a live website this is off (false). You can read how to view errors safely without showing them to visitors in lesson 5.4.
• Settings you add yourself (for example DISALLOW_FILE_EDIT in lesson 7.4 or DISABLE_WP_CRON in lesson 6.3) belong above the "stop editing" line.

wp-config.php contains your database password. Never share the file, never keep a copy of it in the web directory (such as wp-config.php.bak or wp-config.old: anyone can download these because the web server doesn't execute them as PHP) and give it strict file permissions (lesson 7.4).

.htaccess

With LiteSpeed and Apache, the web directory contains an .htaccess file with rules for the web server. Its name starts with a dot, so it's hidden in many programs. WordPress adds this block for clean addresses (permalinks):

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

In plain terms: "if this isn't an existing file (!-f) and isn't an existing folder (!-d), hand it to index.php." That's step 2 from lesson 1.2. Plugins (caching, security) often add their own blocks. Keep your own rules outside the blocks belonging to WordPress and plugins, because those blocks sometimes get rewritten. With nginx, .htaccess doesn't exist; there, the host handles this in the server configuration.

The database: which table does what

With phpMyAdmin (in DirectAdmin under Database management) you can look inside the database. A standard installation has twelve tables; plugins often add more. The most important ones:

Two useful things to know. First: wp_options holds siteurl and home. If these are wrong (for example after a migration), your website sends everyone to the wrong address and you can no longer reach the admin area. You can then restore them in phpMyAdmin or with rules in wp-config.php (lesson 3.1). Second: many settings are stored serialised, a PHP format where the length of each piece of text is counted. If you edit such a value by hand, or run a simple "find and replace" on the database, that length no longer matches and the setting breaks (lesson 3.2).

Looking around in phpMyAdmin is safe. Only make changes if you know what you're doing, and always with a backup.

In practice: what this looks like in a panel

We'll use DirectAdmin as an example. In cPanel and Plesk, the components are also called File Manager and phpMyAdmin.

1. Open File Manager and go to domains/example.com/public_html. Turn on showing hidden files to see .htaccess.
2. Click wp-config.php and choose to view it (not edit). Find DB_NAME and $table_prefix.
3. Open phpMyAdmin, choose the database with that name on the left and see which tables exist.
4. Click the wp_options table (with your prefix) and find the rows siteurl and home.

Summary

• A WordPress website is files plus a database; a backup needs both.
• wp-admin, wp-includes and the separate core files belong to WordPress; wp-content is yours.
• wp-config.php contains the database details, the keys and salts, the table prefix and settings such as WP_DEBUG. Never keep a copy of it in the web directory.
• .htaccess sends everything that isn't a file to index.php; put your own rules outside WordPress's blocks.
• wp_options holds siteurl and home; don't edit serialised data by hand.

Quiz

Exercise

Exercise D1.3: Explore your own installation. Open your web directory in File Manager or with an FTP program, then your database in phpMyAdmin. Don't do anything other than look. Tick off what you've found and fill in: the table prefix, the number of tables in the database, the values of siteurl and home in wp_options, and the folders in wp-content. Also note whether there are files in wp-content/mu-plugins and whether you know where they came from. Never share your database password, not even in this form.

Further reading

These articles describe the steps in WebOké's panels; they work similarly in other panels.

• DirectAdmin guide 11.1: Opening File Manager: the directories in your package
• DirectAdmin guide 11.4: Showing and editing hidden files such as .htaccess
• DirectAdmin guide 12.3: Opening and using phpMyAdmin
• What is the username / password / database name for MySQL?
• DirectAdmin guide 18.6: Error establishing a database connection
• wp-config.php (developer.wordpress.org, English): https://developer.wordpress.org/advanced-administration/wordpress/wp-config/