Tiny File Manager | configuration-20261027004652.md

Back Back Up Advanced Editor

# Settings

Almost everything is changed on the **Settings** page in the admin. There is no file to edit. For people who want more control, an optional `config.php` can override the page. Both are covered here.

## How settings work

There are three layers. Later ones win.

1. **Built-in defaults.** The blog works with these from the first visit.
2. **The Settings page.** What you save is stored in `data/settings.php`.
3. **`config.php` (optional).** For advanced users. Anything set here overrides the Settings page, and that setting shows as *Set in config.php* and is greyed out in the admin.

Changes take effect immediately. There is nothing to restart.

## The Settings page

### Your blog

### Reading

### Analytics

### Comments

| Setting | What it does |
| - | - |
| Comments | **Off** (the default): no comments are shown or accepted. **On, I approve each comment first:** new comments wait in the admin until you approve them. **On, show comments right away:** comments appear at once, except any with more than two links, which wait for approval. **Closed:** existing comments stay visible, no new ones are accepted |

See [Comments](comments.md) for how they work and how they are protected from spam.

### Reading aids

| Setting | What it does |
| - | - |
| Show a reading progress bar on posts | A thin bar at the top of the screen that fills as the reader works through the post. It measures the post's own text, so the footer and the next/previous links do not count. It hides itself when the whole post fits on screen. About 1 KB of script |
| Show a “keep reading” fade on posts | A soft fade at the bottom of the screen with a small “Keep reading” pill while there is more of the post to read, plus edge shadows on wide code blocks and tables. It uses Themestrap's `PluginScrollShadow`, which needs jQuery, so it adds about 110 KB to post pages. Turn it off for the lightest possible pages |

Both are on by default. They only appear on post pages, never on the home page or lists.

### Advanced options

These are folded away on purpose. The defaults suit almost everyone.

#### Footer line

A short line added to the footer after the copyright.

#### Page links

Plain links are not a problem, just longer. Pretty links look nicer in search results and when shared.

Pretty links turn on by themselves when they can. In Automatic mode the blog notices when a clean address reaches it, and it also tests your server during setup and whenever you press **Test my server again**.

If you force “Always pretty” on a server that cannot do it, links break. To recover, open `yoursite/index.php?r=admin/settings`, which works on every server, and switch back to Automatic.

#### Where posts are kept

Switching copies your posts across automatically. The old copy is left in place, so you can switch back safely. See [Storage](storage.md).

#### Post file format

Why this exists: some servers hand out any file you ask for. That would let someone read a *draft* if they guessed its address. The blog tests for this and picks the format for you.

#### Theme

Choose from the folders in `theme/`. See [Themes](themes.md).

#### Posts in the RSS feed

How many recent posts appear in `/feed.xml` (1 to 100).

#### Site address

Leave empty. The blog works out its own address. Fill it in only when your site sits behind a proxy or CDN that changes the address, or to force `https://`. Include any folder: `https://example.com/blog`.

#### Update address and automatic checks

| Setting | What it does |
| - | - |
| Update address | Where to look for new versions: the `latest.json` address, a folder that contains it, or a GitHub repository address (`https://github.com/OWNER/REPO`). Leave empty to use the one built into your copy |
| Look for updates automatically | Checks about once a day when you open the admin. Off means only when you press the button |

See [Updates](updates.md).

#### Allow HTML inside posts

Lets posts contain raw HTML, which is how video embeds work. Anyone who can sign in could then run script on your site, so turn it on only when you are the only author. Public pages also then allow `https:` frames in their security policy.

### Password

Change your password here. You need the current one. A password set in `config.php` must be changed there.

### Backup

**Download a backup** gives you a zip with your posts, pictures, settings and password file. It needs the zip feature on the server, which almost every host has. If yours does not, the page says so and tells you which folders to copy by hand.

### Health

A plain-language checklist about your server: PHP version, whether the blog can save in its folders, the biggest picture it can upload, whether the connection is secure, whether pretty links are on, and whether private files are safe. Each line says what it means and how to fix it. **Test my server again** repeats the browser-side checks.

## The optional `config.php`

You never need this. It exists for people who want settings under version control, to lock a setting so it cannot be changed from the admin, or to move folders. To use it, copy `config.sample.php` to `config.php` and remove the `//` from the lines you want.

```php
<?php
return [
    'title'    => 'My Blog',
    'timezone' => 'America/New_York',
    'pretty_urls' => 'on',
];
```

Every key:

### Moving folders out of the web root

On a host where you can reach folders above the public one, you can keep private data entirely out of reach of the web:

```php
'data_dir'    => '/home/you/private/blog-data',
'content_dir' => '/home/you/private/blog-content',
```

Use absolute paths with no trailing slash. The blog creates the folders if it can. Existing files are not moved for you: copy `data/` and `content/` there first. `uploads/` must stay inside the public folder because images are served from it.

### Settings keys you cannot move to config.php

These are fixed in the code on purpose. Each is a single number you can edit if you need to.

Big pictures are shrunk in the browser before upload, so the server limit rarely matters. See [Hosting](deployment.md#php-settings) to raise it anyway.