Site security guide

WordPress keys and salts: what to rotate, and when.

The eight secrets in wp-config.php help protect authentication cookies and nonces. Replace them deliberately, not reflexively.

5 min readUpdated 26 July 2026wp-config.php reference

Four keys

  • AUTH_KEY
  • SECURE_AUTH_KEY
  • LOGGED_IN_KEY
  • NONCE_KEY

Four salts

  • AUTH_SALT
  • SECURE_AUTH_SALT
  • LOGGED_IN_SALT
  • NONCE_SALT

These values are installation-specific secrets. WordPress combines them with authentication data to make cookies and nonces difficult to forge or reuse elsewhere.

What changes when you rotate them?

Replacing the values invalidates existing authentication cookies. In practice, everyone currently signed in—including you—will need to sign in again. The database, posts, media, and account passwords are not changed; it is a session reset, not a password reset.

That makes rotation useful after a suspected compromise, after secrets appeared in a repository or backup, or when you deliberately need to force a global sign-out. It also means rotation should be coordinated on an active site so administrators and users know why they were logged out.

Rotate now

  • A secret was committed to a public repository.
  • You suspect server, backup, or credential exposure.
  • You need to invalidate all active sessions.
  • You inherited a site with known placeholder values.

Usually wait

  • Nothing has been exposed and no session reset is needed.
  • You are rotating solely because a calendar reminder fired.
  • The site is in a sensitive maintenance window.
  • You cannot coordinate the expected global sign-out.

How to replace the values safely

  1. 01
    Back up wp-config.php.

    Keep a private, recoverable copy before editing the configuration. Do not put that backup in a public project or support ticket.

  2. 02
    Generate a complete set.

    Use the local generator to create all eight definitions. Generate once, copy once, and keep the result private.

  3. 03
    Replace the existing block.

    In wp-config.php, replace the eight matching define() lines from AUTH_KEY through NONCE_SALT. Do not duplicate a constant or leave half the old set in place.

  4. 04
    Save and test.

    Load the site, sign in again, and confirm any integrations that depend on authenticated sessions behave as expected.

WP-CLI alternative

When you have authorized shell access and WP-CLI is installed, wp config shuffle-salts can refresh the standard values in the configuration file. It is still a production change: make a backup, use the correct site directory, and expect every active session to end.

Keep the new values safe

  1. Keep wp-config.php outside version control, or use an encrypted secret-management workflow.
  2. Remove exposed keys from public history and backups where your retention process allows it.
  3. Do not send the generated values in chat, email, screenshots, or support tickets.
  4. Record that a session reset occurred, without recording the secret values themselves.

Primary reference: WordPress wp-config.php documentation and WP-CLI shuffle-salts.