Configure in wp config

Use this page when you manage SafeHouse on many sites, or when the configuration should live in code instead of the database. You can force modules on or off, make the settings page read-only, keep secrets out of the database and copy settings from one site to another.

Every constant on this page goes in wp-config.php, above the line /* That's all, stop editing! Happy publishing. */. The full list is on Configuration constants.

Pin modules on or off

SHOUSE_MODULES forces modules on or off on every request, whatever the settings page says:

define( 'SHOUSE_MODULES', [
	'hardening'    => true,
	'login_limits' => true,
	'lockdown'     => true,
	'scripts'      => false,
] );

• Keys are module IDs. Values are true or false.
• Modules you leave out follow the settings page as usual.
• On the settings page, a pinned module's switch is locked and shows "Pinned by SHOUSE_MODULES in wp-config.php."
• wp shouse status shows SHOUSE_MODULES in the source column for pinned modules.
• wp shouse module enable or disable on a pinned module warns "… is pinned by SHOUSE_MODULES in wp-config.php; the saved setting has no effect." It still changes the saved setting, which takes effect if you remove the pin.
• A module that is Unavailable (for example Omnibus price history without WooCommerce) does not run even when pinned on.

Pinning skips the actions a module takes when you switch it in the settings. When you pin Maintenance mode on or off, SafeHouse does not clear page caches or write the log entry it writes for a switch on the settings page. When you pin Omnibus price history back on, its "recording since" date is not reset.

Make the settings page read-only

define( 'SHOUSE_LOCK_SETTINGS', true );

With this constant:

• every field and switch on the SafeHouse settings page is disabled, and Save Changes is gone
• the page shows "Settings are locked by SHOUSE_LOCK_SETTINGS in wp-config.php. Change them in code."
• module buttons such as Check now, Lift all lockouts and Unlock installs for 30 minutes keep working

The lock applies to the settings page only. WP-CLI commands such as wp shouse module enable still change the saved settings. To keep a module on or off whatever happens, pin it with SHOUSE_MODULES as well.

To stop people from unlocking Install lockdown in the browser, so that unlocking needs WP-CLI:

define( 'SHOUSE_LOCKDOWN_UI_UNLOCK', false );

Keep secrets in wp-config

Credentials are never stored in the database. They are read only from constants:

What	Constants	Page
SMTP server	SHOUSE_SMTP_HOST, SHOUSE_SMTP_PORT, SHOUSE_SMTP_SECURE, SHOUSE_SMTP_USER, SHOUSE_SMTP_PASS	SMTP mail
Cloudflare Turnstile	SHOUSE_TURNSTILE_SITE_KEY, SHOUSE_TURNSTILE_SECRET_KEY	Bot protection
Cloudflare cache clearing	SHOUSE_CLOUDFLARE_TOKEN, SHOUSE_CLOUDFLARE_ZONE	Cloudflare cache
Redis	WP_REDIS_HOST, WP_REDIS_PASSWORD and related	Redis object cache

Other settings that exist only as constants:

What	Constants	Page
Proxies in front of the site	SHOUSE_TRUSTED_PROXIES, SHOUSE_PROXY_HEADER	Behind Cloudflare or a proxy
Addresses Login limits never locks out	SHOUSE_LOGIN_ALLOWLIST (added to the list on the settings page)	Login limits
Updates	SHOUSE_DISABLE_UPDATES, SHOUSE_AUTO_UPDATE	Deploy with git or CI
Run features other plugins already cover	SHOUSE_IGNORE_OVERLAPS	Running with Wordfence
Safe mode	SHOUSE_SAFE_MODE	Recover from a lockout

Copy settings to another site

Module settings, such as the Login limits thresholds or the alert recipients, have no constants. They live in one option, shouse_settings. To give several sites the same settings, export it from one site and import it on the others with WP-CLI.

On the site you copy from:

wp option get shouse_settings --format=json > shouse-settings.json

On each site you copy to:

wp option update shouse_settings --format=json < shouse-settings.json

The import goes straight into the database without the checks the settings page runs. Copy only between sites that run the same SafeHouse version. SafeHouse writes "Settings changed: …" to the activity log and reacts to the change as it would to a save on the settings page.

Related pages

• Configuration constants
• Deploy with git or CI
• Modules
• Command line reference