Configuration constants

SafeHouse reads these constants from wp-config.php. Add them above the line /* That's all, stop editing! Happy publishing. */. A constant always wins over the settings page; where it replaces a setting, that field is locked and says so. This page lists every constant in SafeHouse 0.2.0.

"On" for a true/false constant means defined and truthy: define( 'SHOUSE_SAFE_MODE', true );.

Quick reference

Constant	Type	Default	Section
SHOUSE_SAFE_MODE	true/false	off	General
SHOUSE_MODULES	array	none	General
SHOUSE_LOCK_SETTINGS	true/false	off	General
SHOUSE_IGNORE_OVERLAPS	true/false	off	General
SHOUSE_TRUSTED_PROXIES	'cloudflare' or array	none	Proxies
SHOUSE_PROXY_HEADER	string	HTTP_X_FORWARDED_FOR	Proxies
SHOUSE_LOGIN_ALLOWLIST	array	none	Login limits
SHOUSE_TURNSTILE_SITE_KEY	string	none	Bot protection
SHOUSE_TURNSTILE_SECRET_KEY	string	none	Bot protection
SHOUSE_LOCKDOWN_UI_UNLOCK	true/false	true	Install lockdown
SHOUSE_SMTP_HOST	string	none	SMTP mail
SHOUSE_SMTP_PORT	integer	587	SMTP mail
SHOUSE_SMTP_SECURE	string	'tls'	SMTP mail
SHOUSE_SMTP_USER	string	none	SMTP mail
SHOUSE_SMTP_PASS	string	none	SMTP mail
SHOUSE_CLOUDFLARE_TOKEN	string	none	Cloudflare cache
SHOUSE_CLOUDFLARE_ZONE	string	none	Cloudflare cache
SHOUSE_OBJECT_CACHE	true/false	true	Redis object cache
WP_REDIS_*	various	see below	Redis object cache
SHOUSE_DISABLE_UPDATES	true/false	off	Updates
SHOUSE_AUTO_UPDATE	true/false	true	Updates

Constants for local development are listed under Development only.

General

SHOUSE_SAFE_MODE

Stops every module while on, without changing any setting. Also stops the SafeHouse Redis object cache. Use it to recover when a setting locks you out.

define( 'SHOUSE_SAFE_MODE', true );

The file wp-content/shouse-safe-mode and wp shouse safe-mode on do the same. wp shouse safe-mode off removes the file but not this constant. See Recover from a lockout.

SHOUSE_MODULES

Forces modules on or off, whatever the settings page says. Keys are module IDs, values true or false. Modules not listed follow the settings page. A pinned module's switch is locked and shows "Pinned by SHOUSE_MODULES in wp-config.php." A module that is Unavailable does not run even when pinned on.

define( 'SHOUSE_MODULES', [ 'lockdown' => true, 'scripts' => false ] );

See Configure in wp-config.

SHOUSE_LOCK_SETTINGS

Makes the SafeHouse settings page read-only. Module buttons such as Check now still work, and WP-CLI commands still change saved settings.

define( 'SHOUSE_LOCK_SETTINGS', true );

SHOUSE_IGNORE_OVERLAPS

Runs SafeHouse features even where Wordfence, another plugin or wp-config.php already provides them. Without it, those features step aside and show "Handled by …, skipped here." Also makes Vulnerability alerts, Login limits and LiteSpeed page cache available when Wordfence or the LiteSpeed Cache plugin would otherwise make them Unavailable.

define( 'SHOUSE_IGNORE_OVERLAPS', true );

See Running with Wordfence.

Proxies and visitor addresses

SHOUSE_TRUSTED_PROXIES

Tells SafeHouse which proxy sits in front of the site, so it can read the real visitor address. Replaces Proxy in front of the site on the settings page.

• 'cloudflare': trust Cloudflare's CF-Connecting-IP header on connections from Cloudflare's address ranges.
• An array of addresses and CIDR ranges: trust the header named by SHOUSE_PROXY_HEADER on connections from these addresses.
• Any other value: trust no proxy.

define( 'SHOUSE_TRUSTED_PROXIES', 'cloudflare' );
define( 'SHOUSE_TRUSTED_PROXIES', [ '10.0.0.0/8', '203.0.113.10' ] ); // or this, not both

See Behind Cloudflare or a proxy.

SHOUSE_PROXY_HEADER

The header that carries the visitor address, for proxies listed in SHOUSE_TRUSTED_PROXIES as an array. Written as PHP's $_SERVER key: upper case, dashes as underscores, HTTP_ in front. Ignored with 'cloudflare'. Default HTTP_X_FORWARDED_FOR.

define( 'SHOUSE_PROXY_HEADER', 'HTTP_X_REAL_IP' );

Login limits

SHOUSE_LOGIN_ALLOWLIST

Addresses and CIDR ranges that Login limits never counts, locks out or pauses. Added to Never lock out these addresses on the settings page; both lists apply.

define( 'SHOUSE_LOGIN_ALLOWLIST', [ '203.0.113.7', '198.51.100.0/24' ] );

Bot protection

SHOUSE_TURNSTILE_SITE_KEY

The Cloudflare Turnstile site key. Turnstile runs only when both keys are set. Cloudflare's test keys are refused unless WP_ENVIRONMENT_TYPE is local, development or staging.

define( 'SHOUSE_TURNSTILE_SITE_KEY', '0x4AAAAAAAexample' );

SHOUSE_TURNSTILE_SECRET_KEY

The Cloudflare Turnstile secret key, used by the server to check each form. Never shown on the settings page.

define( 'SHOUSE_TURNSTILE_SECRET_KEY', '0x4AAAAAAAexample-secret' );

See Bot protection.

Install lockdown

SHOUSE_LOCKDOWN_UI_UNLOCK

Set to false to remove Unlock installs for 30 minutes from the settings page, so that only wp shouse unlock can unlock installs. Default: the button is shown.

define( 'SHOUSE_LOCKDOWN_UI_UNLOCK', false );

See Install lockdown.

SMTP mail

The SMTP mail module reads its server and credentials only from these constants.

SHOUSE_SMTP_HOST

The SMTP server. Required: without it, the module does not configure SMTP and mail goes through PHP's mail().

SHOUSE_SMTP_PORT

The SMTP port. Default 587. Use 465 with 'ssl'.

SHOUSE_SMTP_SECURE

Encryption: 'tls' (STARTTLS, the default), 'ssl' (implicit TLS), or exactly '' for none. Any other value sets no explicit encryption but still lets the connection upgrade to TLS when the server offers it.

SHOUSE_SMTP_USER

The login for SMTP authentication. Without it, SafeHouse connects without logging in.

SHOUSE_SMTP_PASS

The password for SHOUSE_SMTP_USER. Used only when SHOUSE_SMTP_USER is set.

define( 'SHOUSE_SMTP_HOST', 'smtp.example.com' );
define( 'SHOUSE_SMTP_PORT', 587 );
define( 'SHOUSE_SMTP_SECURE', 'tls' );
define( 'SHOUSE_SMTP_USER', 'site@example.com' );
define( 'SHOUSE_SMTP_PASS', 'app-password' );

Cloudflare cache

The Cloudflare cache module is Unavailable until both constants are set.

SHOUSE_CLOUDFLARE_TOKEN

A Cloudflare API token allowed only to purge this zone's cache (Zone → Cache Purge).

SHOUSE_CLOUDFLARE_ZONE

The zone ID from the Cloudflare dashboard: 32 hexadecimal characters. Any other value counts as missing.

define( 'SHOUSE_CLOUDFLARE_TOKEN', 'your-api-token' );
define( 'SHOUSE_CLOUDFLARE_ZONE', '0123456789abcdef0123456789abcdef' );

Redis object cache

SHOUSE_OBJECT_CACHE

Set to false to switch the Redis object cache off without removing its drop-in. WordPress then uses its own cache. WP_REDIS_DISABLED set to true does the same.

define( 'SHOUSE_OBJECT_CACHE', false );

WP_REDIS_* constants

The Redis connection. These are the names the Redis Object Cache plugin uses, so a site can switch between the two. SafeHouse reads only these:

Constant	Default	Meaning
WP_REDIS_SCHEME	tcp	tcp, tls or unix
WP_REDIS_HOST	127.0.0.1	Server address
WP_REDIS_PORT	6379	Server port
WP_REDIS_PATH	/var/run/redis/redis.sock	Socket path, with unix
WP_REDIS_PASSWORD	none	A password, or [ 'user', 'password' ]
WP_REDIS_DATABASE	0	Database number
WP_REDIS_TIMEOUT	1	Connect timeout in seconds
WP_REDIS_READ_TIMEOUT	1	Read timeout in seconds
WP_REDIS_PREFIX	derived from the site	Key prefix; SafeHouse adds wph:
WP_CACHE_KEY_SALT	none	Used as the prefix when WP_REDIS_PREFIX is not set
WP_REDIS_DISABLED	off	true switches the cache off

Other WP_REDIS_* constants, such as WP_REDIS_MAXTTL or cluster and sentinel settings, are not supported.

Updates

SHOUSE_DISABLE_UPDATES

Turns update checks off completely. Use it on sites deployed from git or rsync, where the next deploy would undo an update. See Deploy with git or CI.

define( 'SHOUSE_DISABLE_UPDATES', true );

SHOUSE_AUTO_UPDATE

Set to false so that SafeHouse no longer switches on background updates for itself. Updates are still offered on the Plugins and Updates screens. See Signed updates.

define( 'SHOUSE_AUTO_UPDATE', false );

Development only

These constants work only when WP_ENVIRONMENT_TYPE is local or development. On any other site SafeHouse ignores them.

Constant	Meaning
SHOUSE_UPDATE_URL	Another release manifest address, for testing updates
SHOUSE_UPDATE_PUBLIC_KEYS	An array of base64 public keys that replace the release key
SHOUSE_ADVISORY_URL	Another vulnerability data index address
SHOUSE_ADVISORY_PUBLIC_KEYS	An array of base64 public keys for the vulnerability data
SHOUSE_CLOUDFLARE_API	Another Cloudflare API base address, for a mock server

WordPress constants SafeHouse respects

Constant	Effect in SafeHouse
DISALLOW_FILE_MODS	Install lockdown is Unavailable, because WordPress already blocks installs and updates. Hardening's file editor switch shows "Handled by wp-config.php, skipped here."
DISALLOW_FILE_EDIT	Hardening's file editor switch shows "Handled by wp-config.php, skipped here."
DISALLOW_UNFILTERED_HTML	Header and footer scripts is Unavailable.
WP_ENVIRONMENT_TYPE	Allows Turnstile test keys outside production, and the development-only constants on local and development. WordPress treats a site without it as production.
AUTH_KEY, AUTH_SALT, SECURE_AUTH_KEY, NONCE_KEY, DB_PASSWORD	Used to sign Login limits device cookies, the Bot protection honeypot proof and Redis cache values. Changing them invalidates all three: browsers get new device cookies at their next login, cached pages with honeypot forms need a cache purge, and the Redis cache refills.

Names from WPHouse

Every WPHOUSE_* constant from before version 0.2.0 still works as its SHOUSE_* twin. When both are defined, the SHOUSE_* one wins. See Upgrade from WPHouse.

Related pages

• Configure in wp-config
• Command line reference
• Modules