---
title: WordPress salts
canonical: https://wpsecurityninja.com/dictionary/wordpress-salts/
---
# WordPress salts

WordPress salts are secret keys in wp-config.php that help secure cookies, nonces, and related cryptographic operations.

Last updated: 2026-08-26

Also called: security keys, AUTH_KEY, salt keys

## Related terms

- [wp-config.php](https://wpsecurityninja.com/dictionary/wp-config/): wp-config.php holds database credentials, keys, and core WordPress settings for the site.
- [Session hijacking](https://wpsecurityninja.com/dictionary/session-hijacking/): Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- [Assume breach](https://wpsecurityninja.com/dictionary/assume-breach/): Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- [Incident response](https://wpsecurityninja.com/dictionary/incident-response/): Incident response is the structured process of detecting, containing, cleaning, and learning from a security incident.

[Full guide](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/)

## FAQ

### Are WordPress salts the same as my admin password?

No. Your password is what you type at login. Salts are long secret keys in wp-config.php that help protect cookies and nonces. After a breach you usually change both: passwords for people, and salts so old sessions stop working.

### Why does regenerating salts log everyone out?

Session cookies depend on those keys. New salts make existing cookies invalid, which is the point after a compromise. Staff and customers simply sign in again.

## Why it matters for WordPress

`AUTH_KEY`, `SECURE_AUTH_KEY`, and the other salts in `wp-config.php` make session cookies and nonces harder to forge. If those secrets leak (or you inherited a site with keys copied from a tutorial), attackers have an easier time with stolen cookies. Regenerating salts invalidates existing sessions. That is often what you want after a breach.

## How it shows up in practice

- Eight long random constants near the top of `wp-config.php`
- Everyone logged out after you rotate salts (expected)
- Compromised sites that still work for the attacker until salts and passwords both change
- Starter configs that reused the same example keys across many sites

## What to do

1. Use unique, randomly generated keys from a trusted generator (WordPress.org provides one).
2. After a compromise, regenerate salts and rotate passwords together.
3. Never commit real salts to a public repository.
4. Keep `wp-config.php` out of web-reachable backup dumps.