{"id":17608,"date":"2011-03-01T19:59:47","date_gmt":"2011-03-01T14:29:47","guid":{"rendered":"https:\/\/www.quickonlinetips.com\/archives\/?p=17608"},"modified":"2026-10-14T19:26:19","modified_gmt":"2026-10-14T13:56:19","slug":"wordpress-secret-keys-better-wordpress-security","status":"publish","type":"post","link":"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/","title":{"rendered":"How to Change WordPress Secret Keys and Salts (2026)"},"content":{"rendered":"<p>WordPress secret keys (also called security keys and salts) are eight long random strings in your <code>wp-config.php<\/code> file that encrypt the login cookies of every user. I once checked some old WordPress blogs and found outdated, incomplete keys, a gap that makes stolen cookies easier to abuse. Changing your <strong>WordPress secret keys<\/strong> is one of the quickest security fixes you can make, and it instantly logs out everyone, including any hacker who is secretly logged in.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-64120\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-secret-keys-salts-1024x538.webp\" alt=\"How to change WordPress secret keys and salts\" width=\"1024\" height=\"538\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-secret-keys-salts-1024x538.webp 1024w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-secret-keys-salts-300x158.webp 300w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-secret-keys-salts-150x79.webp 150w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-secret-keys-salts-768x403.webp 768w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-secret-keys-salts.webp 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p><strong>Quick answer:<\/strong> Open the official WordPress secret key generator, copy the eight new lines, and replace the matching <code>AUTH_KEY<\/code> to <code>NONCE_SALT<\/code> lines in <code>wp-config.php<\/code>. Save the file and every user is logged out. Or run <code>wp config shuffle-salts<\/code> with WP-CLI, or use a plugin such as Salt Shaker to rotate the keys on a schedule.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6ae415eabd352\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"ez-toc-cssicon\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #1a202c;color:#1a202c\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #1a202c;color:#1a202c\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ae415eabd352\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#What_are_WordPress_secret_keys\" >What are WordPress secret keys?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#When_should_you_change_WordPress_secret_keys\" >When should you change WordPress secret keys?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#How_to_change_WordPress_secret_keys_manually\" >How to change WordPress secret keys manually<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#Other_ways_to_rotate_keys_and_salts\" >Other ways to rotate keys and salts<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#WP-CLI\" >WP-CLI<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#Security_plugins\" >Security plugins<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#Troubleshooting\" >Troubleshooting<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#Will_changing_secret_keys_break_my_site\" >Will changing secret keys break my site?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#Do_I_need_to_change_user_passwords_too\" >Do I need to change user passwords too?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/#How_often_should_I_change_WordPress_secret_keys\" >How often should I change WordPress secret keys?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"What_are_WordPress_secret_keys\"><\/span>What are WordPress secret keys?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Secret keys were added in WordPress 2.5 as a single <code>SECRET_KEY<\/code> for secure cookies. Today there are eight constants: four keys and four matching salts.<\/p>\n<ul>\n<li><strong>AUTH_KEY<\/strong> and <strong>AUTH_SALT<\/strong>: sign the admin cookie over plain HTTP.<\/li>\n<li><strong>SECURE_AUTH_KEY<\/strong> and <strong>SECURE_AUTH_SALT<\/strong>: sign the admin cookie over HTTPS.<\/li>\n<li><strong>LOGGED_IN_KEY<\/strong> and <strong>LOGGED_IN_SALT<\/strong>: sign the cookie that marks a visitor as logged in.<\/li>\n<li><strong>NONCE_KEY<\/strong> and <strong>NONCE_SALT<\/strong>: protect nonces, the one-time tokens that stop forged form submissions.<\/li>\n<\/ul>\n<p>If a constant is missing or still says <em>put your unique phrase here<\/em>, WordPress falls back to values stored in the database, which is weaker if your database is ever leaked.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"When_should_you_change_WordPress_secret_keys\"><\/span>When should you change WordPress secret keys?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>After a hack, malware clean-up or a suspicious admin login.<\/li>\n<li>When a developer, freelancer or staff member with admin access leaves.<\/li>\n<li>If your <code>wp-config.php<\/code> or a site backup was exposed.<\/li>\n<li>On an old site whose keys were never set or are incomplete.<\/li>\n<li>As routine hygiene, for example every few months.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"How_to_change_WordPress_secret_keys_manually\"><\/span>How to change WordPress secret keys manually<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ol>\n<li>Back up <code>wp-config.php<\/code> first (download a copy via your host&#8217;s File Manager or <a href=\"https:\/\/filezilla-project.org\/\" target=\"_blank\" rel=\"noopener\">FileZilla<\/a>).<\/li>\n<li>Open the official <a href=\"https:\/\/api.wordpress.org\/secret-key\/1.1\/salt\/\" target=\"_blank\" rel=\"noopener\">WordPress secret key generator<\/a>. Every refresh gives eight fresh random lines.<\/li>\n<li>Open <code>wp-config.php<\/code> in a plain text editor such as Notepad++ or VS Code, not a word processor.<\/li>\n<li>Replace the eight existing <code>define( 'AUTH_KEY', ... );<\/code> to <code>define( 'NONCE_SALT', ... );<\/code> lines with the new ones. Don&#8217;t add a second set.<\/li>\n<li>Save and upload the file. You will be logged out; log back in.<\/li>\n<\/ol>\n<h2><span class=\"ez-toc-section\" id=\"Other_ways_to_rotate_keys_and_salts\"><\/span>Other ways to rotate keys and salts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"WP-CLI\"><\/span>WP-CLI<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If your host offers SSH, run this in the WordPress folder:<\/p>\n<pre><code>wp config shuffle-salts<\/code><\/pre>\n<p>It writes fresh keys and salts to <code>wp-config.php<\/code> in one step. See <a href=\"https:\/\/wp-cli.org\/\" target=\"_blank\" rel=\"noopener\">WP-CLI<\/a> for setup.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Security_plugins\"><\/span>Security plugins<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong><a href=\"https:\/\/www.wordfence.com\/\" target=\"_blank\" rel=\"noopener\">Wordfence<\/a><\/strong> and other security suites include tools to regenerate keys from the dashboard.<\/li>\n<li><strong>Salt Shaker<\/strong> is a small plugin that can change salts automatically on a schedule.<\/li>\n<\/ul>\n<p>For a full list, see our guide to the <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/wordpress-security-plugins\/\">best WordPress security plugins<\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Troubleshooting\"><\/span>Troubleshooting<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>White screen or syntax error:<\/strong> a quote or semicolon was lost while pasting. Restore your backup and paste again.<\/li>\n<li><strong>Logged out constantly:<\/strong> check that each constant appears only once and that no plugin rotates salts on every load.<\/li>\n<li><strong>Users complain:<\/strong> warn members before rotating; everyone must log in again.<\/li>\n<\/ul>\n<p>Changing keys is one layer. For the rest, read how to <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/\">increase WordPress security<\/a>.<\/p>\n<p><em>NB: <span style=\"color: #ff0000;\">Edit wp-config.php only if you know what you are doing<\/span>, or your site can go offline. Keep a backup and seek professional WordPress help if unsure.<\/em><\/p>\n<h2><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Will_changing_secret_keys_break_my_site\"><\/span>Will changing secret keys break my site?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. It only invalidates cookies, so everyone is logged out. Content, passwords and settings are untouched.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Do_I_need_to_change_user_passwords_too\"><\/span>Do I need to change user passwords too?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>After a hack, yes. New keys end current sessions, but a stolen password still works until it is changed.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"How_often_should_I_change_WordPress_secret_keys\"><\/span>How often should I change WordPress secret keys?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>There is no fixed rule. Change them after any security incident or staff change, and every few months as routine.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress secret keys (also called security keys and salts) are eight long random strings in your wp-config.php file that encrypt&#8230;<\/p>\n","protected":false},"author":4,"featured_media":64120,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[6,7],"tags":[49,17],"class_list":["post-17608","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogging","category-security","tag-tutorials","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/17608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/comments?post=17608"}],"version-history":[{"count":3,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/17608\/revisions"}],"predecessor-version":[{"id":66519,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/17608\/revisions\/66519"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media\/64120"}],"wp:attachment":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media?parent=17608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/categories?post=17608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/tags?post=17608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}