Question 1

What are WordPress security keys and salts?

Accepted Answer

WordPress security keys and salts are random strings stored in wp-config.php that WordPress uses to hash and encrypt cookies, authentication tokens and session data. There are eight constants: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT and NONCE_SALT. These keys make cookies cryptographically unique to your specific installation — if an attacker intercepts a cookie from another WordPress site, it won't work on yours.

Question 2

When should I regenerate WordPress security keys?

Accepted Answer

Regenerate WordPress security keys immediately after: (1) A site hack or suspected compromise — regenerating keys immediately logs out all active sessions including any attacker who may have persistent access; (2) Giving access to a user or developer who no longer needs it; (3) Moving from HTTP to HTTPS (the SECURE_AUTH keys are used for the SSL login); (4) A fresh installation (the default keys in wp-config-sample.php are publicly known); (5) Any time you have reason to believe cookies may have been intercepted.

Question 3

What happens when I update WordPress security keys?

Accepted Answer

Updating WordPress security keys immediately invalidates all existing authentication cookies and session tokens. This means: (1) Every user currently logged in will be logged out and required to log in again — including you; (2) Any 'Remember me' cookies are invalidated; (3) WordPress nonces (used to protect forms and URLs) are regenerated. This is the intended behavior — it's a security feature. After updating the keys in wp-config.php, you will need to log in again.

Question 4

Where do I put the security keys in wp-config.php?

Accepted Answer

The eight security key and salt define() statements should replace the existing placeholder or default values in wp-config.php. They are typically located between the database configuration section and the table prefix. If you're adding them for the first time, place them just before the line that says '/* That's all, stop editing! Happy publishing. */'. Replace all eight lines at once — partial replacement can cause authentication issues.

Constant	Type	Used for
AUTH_KEY	Key	Hashing non-SSL (HTTP) authentication cookies
SECURE_AUTH_KEY	Key	Hashing SSL (HTTPS) authentication cookies
LOGGED_IN_KEY	Key	Hashing "logged in" cookies that confirm user is signed in
NONCE_KEY	Key	Hashing nonce values used in forms and action URLs
AUTH_SALT	Salt	Additional entropy added to AUTH_KEY hashing
SECURE_AUTH_SALT	Salt	Additional entropy added to SECURE_AUTH_KEY hashing
LOGGED_IN_SALT	Salt	Additional entropy added to LOGGED_IN_KEY hashing
NONCE_SALT	Salt	Additional entropy added to NONCE_KEY hashing

WordPress Salts Generator

The eight security constants

Frequently asked questions

Related WordPress tools

Secure your WordPress site in seconds