WPSalt field notes

WordPress security, made understandable.

Useful, source-backed guides for the moments when you need to recover an account, understand a hash, or rotate your site’s secrets.

Start here

Choose the task in front of you.

Each guide is concise, tied to WordPress Core documentation, and links directly to the relevant local tool.

01 Compatibility Understand a WordPress password hash Learn how $wp$2y$, $P$, bcrypt, and MD5 relate to WordPress versions. Read the guide 02 Account recovery Reset an authorized account safely Start with safer recovery options, then use phpMyAdmin only when it is truly needed. Read the guide 03 Site security Rotate WordPress keys and salts Know what belongs in wp-config.php, when to replace it, and what changes afterward. Read the guide

Recovery and maintenance

Solve the blocker, not just the symptom.

These guides cover the checks that make account recovery safer and help prevent repeat lockouts.

04 Command line Reset a password with WP-CLI Use WordPress’s own user update flow without exposing a password in shell history. Read the guide 05 Database navigation Find the correct WordPress users table Understand prefixes, multisite names, and the fields that confirm you are in the right place. Read the guide 06 Troubleshooting Fix a password reset that is not working Separate email, link, database, and login-plugin failures before making another change. Read the guide 07 Migration troubleshooting wp-admin locked out after moving hosts DNS, IP blocks, staging passwords, permissions — before you touch the login form. Read the guide 08 Database navigation Change the table prefix safely Tables, wp-config.php, and serialized data all need to move together. Read the guide

The bcrypt transition

Make sense of the new $wp$2y$ era.

WordPress 6.8 changed how passwords are stored. These guides cover the new format, the upgrade mechanics, and the migration failures that get blamed on it.

09 Compatibility Why a hash starts with $wp$2y$ What the prefix means, why it appeared, and why it is not a sign of compromise. Read the guide 10 Upgrade mechanics The 6.8 hashing change, explained phpass to bcrypt: what changed, what stayed compatible, and when you must act. Read the guide 11 Troubleshooting Can't log in after a migration Hashes survive the move — diagnose prefixes, URLs, cookies, and plugins in order. Read the guide 12 Authentication WordPress application passwords, explained A separate credential per app, hashed differently on purpose — and why that matters. Read the guide

Apache configuration

Repair the rules without creating a new outage.

Clear, task-led guidance for WordPress rewrite rules, multisite routing, uploads hardening, and HTTPS redirects.

13 Permalinks Restore the default .htaccess file Know which rewrite block WordPress writes, where it belongs, and how to test it safely. Read the guide 14 Network routing Choose the right multisite rules See why subdomain and subdirectory networks need different rewrite blocks. Read the guide 15 Uploads hardening Block PHP inside uploads safely Add a focused Apache control and check the multisite exception before enabling it. Read the guide 16 HTTPS troubleshooting Stop a WordPress redirect loop Find the competing redirect before changing another setting or adding another rule. Read the guide

Security stack map

Choose the layer you actually need.

These tools cover different jobs. Start with the gap in your site, then avoid enabling duplicate controls across multiple plugins.

01 Prevent Firewall and malware scanning Wordfence focuses on blocking malicious traffic, scanning for malware, and protecting logins. Visit Wordfence → 02 Harden HTTPS, hardening, and 2FA Really Simple Security helps with HTTPS enforcement, hardening options, and login protection. Visit Really Simple Security → 03 Audit Security posture and findings Lockora Audit reviews vulnerabilities, configuration issues, and stale dependencies for action. Visit Lockora Audit → 04 Trace Activity and accountability WhoChangedIt records WordPress user activity so teams can see who changed what and when. Visit WhoChangedIt →