# Site settings

Settings live in the database and are edited from **Settings** in the admin panel. Machine-specific values (database credentials, base URL, obscured admin path) live in `.env`, `config/database.local.php` or `config/site.local.php` and are never committed.

The full key list is in [Settings keys](../reference/SETTINGS-KEYS.md).

## General

| Key | Meaning |
|---|---|
| `site.name` | Used in titles, email From names, structured data |
| `site.description` | Default meta description |
| `site.default_locale` | Language shown to a first-time visitor |
| `site.language_mode` | `single` or `multilingual` |
| `site.language_switcher_enabled` | Show the public language switcher |
| `site.browser_locale_detection` | Honour `Accept-Language` for first-time visitors |
| `site.timezone` | Timezone for displayed timestamps |
| `site.admin_path` | The administrator path (for example `w-admin`) |

### Language mode

`single` hides the switcher, browser detection and per-question language choice **together**. Half-disabled multilingualism produces duplicate URLs and confused indexing, so the mode is one switch rather than three.

### Admin path

Changing `site.admin_path` changes the URL immediately. The physical `admin/` directory is not renamed and must not be. Every internal link is generated from this setting.

Because it is an obscurity measure and not an access control, it does not replace authentication — it only reduces automated noise.

## Community

| Key | Meaning |
|---|---|
| `community.question_moderation` | Whether new questions publish immediately or wait |
| `community.comments_enabled` | Global comment switch |
| `community.follows_enabled` | Global follow switch |
| `community.duplicate_suggestions_enabled` | Suggest similar questions while asking |
| `community.spam_moderate_score` | Risk score at which content is held |
| `community.spam_reject_score` | Risk score at which content is refused |

See [Anti-spam](ANTI-SPAM.md).

## Mail

See [SMTP and email](SMTP-EMAIL.md).

## SEO

See [SEO](SEO.md).

## Security

| Key | Meaning |
|---|---|
| `security.strict_csp` | Tighter Content-Security-Policy |
| `security.turnstile_enabled` | Enable the optional challenge |
| `security.turnstile_site_key` / `security.turnstile_secret_key` | Challenge credentials |

Turnstile is **disabled by default** and is not applied to every ordinary post. See [Security](SECURITY.md).

## Ads

| Key | Meaning |
|---|---|
| `ads.enabled` | Global advertising switch |
| `ads.between_answers.interval` | Insert an ad every N answers |
| `ads.between_answers.max_insertions` | Cap per page |

See [Ads and custom code](../02-administration/ADS-CUSTOM-CODE.md).

## Environment values that are not settings

| Value | Where it lives | Why |
|---|---|---|
| Database host/name/user/password | `config/database.local.php` or `.env` | Credentials never belong in the database they unlock |
| `APP_URL` | `.env` | The trusted public origin; reset links never trust the request `Host` header |
| `APP_BASE_URL` | `.env` | Subdirectory base path |
| Obscured admin path | `config/site.local.php` (optional) | Lets an operator keep it out of a shared database dump |
