How to Change WordPress Secret Keys and Salts (2026)

WordPress secret keys (also called security keys and salts) are eight long random strings in your wp-config.php file that encrypt the login cookies of every user. I once checked some old WordPress blogs and found outdated, incomplete keys, a gap that makes stolen cookies easier to abuse. Changing your WordPress secret keys is one of the quickest security fixes you can make, and it instantly logs out everyone, including any hacker who is secretly logged in.

Quick answer: Open the official WordPress secret key generator, copy the eight new lines, and replace the matching AUTH_KEY to NONCE_SALT lines in wp-config.php. Save the file and every user is logged out. Or run wp config shuffle-salts with WP-CLI, or use a plugin such as Salt Shaker to rotate the keys on a schedule.

What are WordPress secret keys?

Secret keys were added in WordPress 2.5 as a single SECRET_KEY for secure cookies. Today there are eight constants: four keys and four matching salts.

• AUTH_KEY and AUTH_SALT: sign the admin cookie over plain HTTP.
• SECURE_AUTH_KEY and SECURE_AUTH_SALT: sign the admin cookie over HTTPS.
• LOGGED_IN_KEY and LOGGED_IN_SALT: sign the cookie that marks a visitor as logged in.
• NONCE_KEY and NONCE_SALT: protect nonces, the one-time tokens that stop forged form submissions.

If a constant is missing or still says put your unique phrase here, WordPress falls back to values stored in the database, which is weaker if your database is ever leaked.

When should you change WordPress secret keys?

• After a hack, malware clean-up or a suspicious admin login.
• When a developer, freelancer or staff member with admin access leaves.
• If your wp-config.php or a site backup was exposed.
• On an old site whose keys were never set or are incomplete.
• As routine hygiene, for example every few months.

How to change WordPress secret keys manually

1. Back up wp-config.php first (download a copy via your host’s File Manager or FileZilla).
2. Open the official WordPress secret key generator. Every refresh gives eight fresh random lines.
3. Open wp-config.php in a plain text editor such as Notepad++ or VS Code, not a word processor.
4. Replace the eight existing define( 'AUTH_KEY', ... ); to define( 'NONCE_SALT', ... ); lines with the new ones. Don’t add a second set.
5. Save and upload the file. You will be logged out; log back in.

Other ways to rotate keys and salts

WP-CLI

If your host offers SSH, run this in the WordPress folder:

wp config shuffle-salts

It writes fresh keys and salts to wp-config.php in one step. See WP-CLI for setup.

Security plugins

• Wordfence and other security suites include tools to regenerate keys from the dashboard.
• Salt Shaker is a small plugin that can change salts automatically on a schedule.

For a full list, see our guide to the best WordPress security plugins.

Troubleshooting

• White screen or syntax error: a quote or semicolon was lost while pasting. Restore your backup and paste again.
• Logged out constantly: check that each constant appears only once and that no plugin rotates salts on every load.
• Users complain: warn members before rotating; everyone must log in again.

Changing keys is one layer. For the rest, read how to increase WordPress security.

NB: Edit wp-config.php only if you know what you are doing, or your site can go offline. Keep a backup and seek professional WordPress help if unsure.

FAQ

Will changing secret keys break my site?

No. It only invalidates cookies, so everyone is logged out. Content, passwords and settings are untouched.

Do I need to change user passwords too?

After a hack, yes. New keys end current sessions, but a stolen password still works until it is changed.

How often should I change WordPress secret keys?

There is no fixed rule. Change them after any security incident or staff change, and every few months as routine.