diff --git a/doc/setup.rst b/doc/setup.rst
index e577689792..7a0dc4beff 100644
--- a/doc/setup.rst
+++ b/doc/setup.rst
@@ -265,6 +265,8 @@ simple configuration may look like this:
     $i=0;
     $i++;
     $cfg['Servers'][$i]['auth_type']     = 'cookie';
+    // if you insist on "root" having no password:
+    // $cfg['Servers'][$i]['AllowNoPasswordRoot'] = true; `
     ?>
 
 Or, if you prefer to not be prompted every time you log in:
@@ -281,6 +283,11 @@ Or, if you prefer to not be prompted every time you log in:
     $cfg['Servers'][$i]['auth_type']     = 'config';
     ?>
 
+.. warning::
+
+    Storing passwords in the configuration is insecure as anybody can then
+    manipulate with your database.
+
 For a full explanation of possible configuration values, see the
 :ref:`config` of this document.