All Seravo environments (production, staging/shadow, and local development) come preconfigured with a set of system environment variables. These keep site configurations, database credentials, and security keys separate from your source code.
You can inspect all active environment variables in your environment via SSH by running:
wp-list-env
Default Seravo Environment Variables
Variable | Description and Purpose |
| Indicates the runtime environment type. In production, the value is always |
| The unique identifier of the server container (e.g., |
| An internal fallback domain generated by Seravo for your site (e.g., |
| Database connection credentials. Always rely on these variables rather than hardcoding passwords or hostnames into your source code. |
| WordPress security keys and salts. Each environment has its own unique set of keys, kept secure outside version control. |
Security Keys in wp-config.php
In Seravo's default setup, WordPress security keys and salts are loaded directly from environment variables using the getenv() function:
/**
* Authentication Unique Keys and Salts
* You can find them by running $ wp-list-env
*/
define('AUTH_KEY', getenv('AUTH_KEY'));
define('SECURE_AUTH_KEY', getenv('SECURE_AUTH_KEY'));
define('LOGGED_IN_KEY', getenv('LOGGED_IN_KEY'));
define('NONCE_KEY', getenv('NONCE_KEY'));
define('AUTH_SALT', getenv('AUTH_SALT'));
define('SECURE_AUTH_SALT', getenv('SECURE_AUTH_SALT'));
define('LOGGED_IN_SALT', getenv('LOGGED_IN_SALT'));
define('NONCE_SALT', getenv('NONCE_SALT'));
Using Environment Variables in Custom Code
You can read environment variables directly in your themes or plugins using PHP's getenv() function (or WordPress's native wp_get_environment_type() function).
For example, you can restrict external analytics or tracking scripts so they only load in production:
if ( getenv( 'WP_ENV' ) === 'production' ) {
// Load tracking scripts only in production
}Defining Custom Variables with a .env File
By default, wp-config.php in Seravo's project template uses the PHP Dotenv library. You can create a .env file in the project root (/data/wordpress/.env) to store application-specific variables, such as third-party API keys.
Example .env file contents:
STRIPE_API_KEY=sk_live_51ExampleKey123456
GOOGLE_MAPS_API_KEY=AIzaSyExampleKey123456
You can then retrieve these keys anywhere in your PHP code using getenv('STRIPE_API_KEY').
Version Control and Environment-Specific Templates
Because the active .env file contains sensitive credentials, it is excluded by default in .gitignore and must never be committed to Git version control.
However, you can track environment-specific template files (such as .env.development or .env.example) without real secrets in Git, and create a symbolic link on the server pointing to the active configuration:
cd /data/wordpress
ln -s .env.development .env
Important: Do Not Override Database Credentials in .env
Seravo's project template loads .env using createUnsafeImmutable() by default. This ensures that critical server-provided environment variables (such as DB_*, WP_ENV, and CONTAINER) cannot be accidentally overwritten by a .env file.
Never copy local development database credentials into your production .env file, as doing so can break your site's database connection during system updates.
Dotenv Versions and wp-config.php Syntax
In modern Seravo installations (PHP Dotenv 5.x), environment variables are loaded in wp-config.php as follows:
$dotenv = Dotenv\Dotenv::createUnsafeImmutable($root_dir);
$dotenv->load();
Note: The word Unsafe in the method name simply indicates that variables are populated into PHP's traditional getenv() interface used by WordPress. This is completely safe and required for compatibility.
Upgrading Legacy Sites (Dotenv 2.x -> 5.x)
If you use Composer to update an older site whose wp-config.php still uses Dotenv 2.x syntax (new Dotenv\Dotenv($root_dir) or Dotenv::load($root_dir)), the site may display a blank error screen after the update, and a fatal Dotenv class error will be logged in /data/log/php-error.log.
To resolve this, update the Dotenv initialization in wp-config.php to match the createUnsafeImmutable($root_dir) syntax shown above. For further details on breaking changes, see the PHP Dotenv upgrading guide.
See Also
Using environment variables and a .env file keeps sensitive credentials secure while making it straightforward to move code across local development, staging, and production environments. If you run into any issues with environment variables or wp-config.php configurations, our support team is happy to help at [email protected].