Help Documentation

VMP™ Security plugin documentation and support

Free Support

Support for users of the free version of the plugin is available on our support forums. The majority of features shown are available in the free version of VMP™ Security which helps protect millions of sites around the world.

Go to support forums

Access Upgraded Support Now

Our support engineers, equipped in Premium tickets within a few hours on weekdays, will be pleased to help you with advanced topics, provide comprehensive answers to your questions, and respond to all others in 24 hours or less.

Premium Support

Constants

VMP Security exposes a small number of PHP constants that can be defined in wp-config.php to override or extend its runtime behaviour. Constants are useful when you need a setting to be locked in (so it cannot be changed from the WordPress admin), when you are provisioning sites from infrastructure-as-code, or when you need to bypass a behaviour temporarily without leaving a record in the database.

In This Article

How to set a constant

Open wp-config.php and add a define() line above the /* That’s all, stop editing! */ comment, for example:

define('VMPFENCE_WAF_STORAGE_ENGINE', 'mysqli');

Constants take effect on the next request. They cannot be changed from the WordPress admin while in place — that is the point of using a constant.

Constants set by the plugin (read-only)

The plugin defines several constants for its own use. You should not redefine these; they are listed here only so you can recognise them in code or diagnostics output.

ConstantValue / typeMeaning
VMPFENCE_VERSIONstringCurrently installed plugin version (e.g. 2.2.8).
VMPFENCE_PLUGIN_FILEstringAbsolute path to the main plugin entry file.
VMPFENCE_PLUGIN_DIRstringAbsolute path to the plugin directory (with trailing slash).
VMPFENCE_PLUGIN_URLstringURL to the plugin directory (with trailing slash).
VMPFENCE_PLUGIN_BASENAMEstringPlugin basename for use with WordPress hooks (e.g. vmpfence/vmpfence.php).
VMPFENCE_DB_VERSIONstringSchema version for the plugin’s database tables.
VMPFENCE_MIN_WP_VERSIONstringMinimum supported WordPress version (currently 5.0).
VMPFENCE_MIN_PHP_VERSIONstringMinimum supported PHP version (currently 7.4).
VMPFENCE_WAF_LOADEDboolSet to true by the early-protection loader (vmp-waf.php) before WordPress boots, used internally to detect Extended Protection.

Constants you can define

ConstantTypeEffect
VMPFENCE_WAF_STORAGE_ENGINEstringSelects the firewall’s storage engine. Currently the supported value is 'mysqli'; leave undefined to use the default. The current value is shown on Tools → Diagnostics.
VMPFENCE_WAF_LOG_FILE_MODEintPOSIX file mode (octal, e.g. 0640) used when the firewall writes its on-disk log files. Override only on hosts where the default permissions cause access problems.
VMPFENCE_DISABLE_NTPboolSet to true to skip the optional NTP-based clock check. Useful on shared hosts that block outbound NTP and where the resulting log noise is unwanted.

Setting any of these constants in wp-config.php overrides the corresponding option in the database. Diagnostics shows which engine and modes are currently in effect, so you can confirm the override has applied.

Relevant WordPress constants

VMP Security inherits behavior from several WordPress core constants. These are not VMP-specific but affect how the plugin works:

  • WP_HTTP_BLOCK_EXTERNAL + WP_ACCESSIBLE_HOSTS: If WP_HTTP_BLOCK_EXTERNAL is true, WP_ACCESSIBLE_HOSTS must include the VMP Security API hostnames (contact support for the current list), *.wordpress.org, and raw.githubusercontent.com for the plugin to fetch rule and signature updates and run file-integrity checks.
  • DISABLE_WP_CRON: If true, scheduled scans, signature sync, and other background jobs only run when an external cron triggers wp-cron.php. Recommended for any site with low traffic.
  • WP_PROXY_HOST / WP_PROXY_PORT: If your environment requires an outbound HTTP proxy, set these and the plugin will route through it.
  • SECURE_AUTH_KEY: Used as input to encryption of sensitive plugin data at rest. Should already be set on every WordPress installation; rotating it without re-keying breaks decryption of existing secrets.
Contents