Security Keys and Salts

Open the wp-config.php file of a typical WordPress site, and you will find eight lines full of random characters. Those lines are the security keys and salts. They are secret values that WordPress uses to protect the login cookies stored in your browser.

You never have to remember them, but they quietly keep every login on your site safe.

What are security keys and salts?

When you log in, WordPress saves a cookie in your browser, so it remembers you. It uses the keys and salts to create a secret signature for that cookie, which makes it very hard for anyone to fake.

Think of a salt as the secret spice in a family recipe. Without it, nobody can copy the exact taste.

The values come in four pairs: AUTH, SECURE_AUTH, LOGGED_IN and NONCE. Each pair has one key and one salt, such as AUTH_KEY and AUTH_SALT. The NONCE pair protects the one-time security tokens WordPress adds to forms and links. In the sample config file, each line starts out like this:

define( 'AUTH_KEY', 'put your unique phrase here' );

When the WordPress installer creates wp-config.php for you, it fills in random values automatically. If you create the file by hand, you must replace these placeholders yourself.

When should you change them?

Change your keys and salts after a hack, when you suspect a stolen password or when a former team member had access to your files. New values make every existing login cookie invalid at once. If your site was attacked, also read how WordPress sites get hacked and how to prevent it.

How to change your WordPress salts

1. First, download a backup copy of wp-config.php using FTP or your host's file manager.
2. Next, open the official WordPress.org secret key generator. It shows fresh values on every reload.
3. Now, replace the old eight lines in wp-config.php with the new ones.
4. Finally, save the file and upload it back to the server.

Keys and salts add a quiet layer of protection that costs you nothing. That's it. Do let us know in the comments if you face any issues while changing them.