How to change WordPress salts and security keys

What this problem looks like

WordPress ships eight authentication constants in wp-config.php. They should be unique per site. After malware or credential leaks, rotating salts invalidates hijacked sessions even if attackers know old passwords.

Changing keys does not delete users or content. Everyone must log in again, including API integrations that rely on application passwords or cookie auth.

Step 1: Generate fresh keys

Open https://api.wordpress.org/secret-key/1.1/salt/ in your browser. Copy the entire block of define statements. Each refresh produces unique random strings.

Step 2: Edit wp-config.php via SFTP

Open wp-config.php in your site root, next to wp-admin and wp-content, via File Manager, SFTP, or FTP. Locate the section labelled Authentication Unique Keys and Salts. Replace all eight lines with the new block. Do not leave duplicate define statements.

php

define( 'AUTH_KEY',         'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
define( 'NONCE_KEY',        'put your unique phrase here' );
define( 'AUTH_SALT',        'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
define( 'NONCE_SALT',       'put your unique phrase here' );

Step 3: Save and confirm the site loads

A syntax error in wp-config.php whitescreens the site. Save carefully and reload the homepage. You should see the site but be logged out of admin.

Step 4: Log in and review admin users

Go to Users → All Users. Delete unknown administrators. Force password resets for remaining admins. Check installed plugins for anything you did not add.

Step 5: Document the change for your team

Tell editors they must log in again. Reconnect integrations that used cookie-based auth. Application passwords in WordPress 5.6+ may need regeneration.

When to stop DIY and hire help

After a hack, rotating salts is one step in a full cleanup. BugShield removes malware, rotates credentials, and hardens wp-config.php at a confirmed fixed price.

Questions answered

WordPress salts and security keys FAQs

Answers about session security, safe key rotation, forced logouts, backups, and recovery after suspected account access.

How often should I rotate WordPress salts?

After suspected compromise or staff departures with admin access. Routine rotation every few months is optional for low-risk blogs.

Will changing salts break WooCommerce checkout?

Active customer carts may reset when sessions invalidate. Do this during low-traffic hours and announce maintenance if needed.

Can I change salts from wp-admin?

No. They live only in wp-config.php on the server. Use File Manager, SFTP, or FTP.

Do salts encrypt the database?

No. They sign cookies and security tokens. Database encryption is a separate hosting feature.

What are WordPress salts and security keys?

They are secret values in wp-config.php used when WordPress signs authentication cookies and other security tokens. Unique random values make those tokens harder to forge.

Will changing WordPress security keys log everyone out?

Yes. Existing login cookies become invalid, so administrators, editors, customers, and other signed-in users must authenticate again.

Should I back up wp-config.php before changing salts?

Yes. Save a secure copy of the file first so you can reverse an accidental syntax or formatting error without exposing the credentials it contains.

Where can I generate new WordPress security keys?

Use the official WordPress.org secret-key service, then replace all eight key and salt definitions together rather than updating only one value.

Should I rotate WordPress salts after a hack?

Yes. Rotate them after removing malicious code and unknown users, then reset passwords and revoke unfamiliar application passwords so old sessions cannot return.

How do I know new WordPress salts are working?

Your existing session should end after the file is saved, and a fresh login should succeed. Check the site and wp-admin for a PHP syntax error before finishing.

Keep troubleshooting

Learn how to change WordPress salts and security keys.