WordPress-specific Dictionary
WordPress salts
Definition
WordPress salts are secret keys in wp-config.php that help secure cookies, nonces, and related cryptographic operations.
Also called: security keys, AUTH_KEY, salt keys
Why it matters for WordPress
AUTH_KEY, SECURE_AUTH_KEY, and the other salts in wp-config.php make session cookies and nonces harder to forge. If those secrets leak (or you inherited a site with keys copied from a tutorial), attackers have an easier time with stolen cookies. Regenerating salts invalidates existing sessions. That is often what you want after a breach.
How it shows up in practice
- Eight long random constants near the top of
wp-config.php - Everyone logged out after you rotate salts (expected)
- Compromised sites that still work for the attacker until salts and passwords both change
- Starter configs that reused the same example keys across many sites
What to do
- Use unique, randomly generated keys from a trusted generator (WordPress.org provides one).
- After a compromise, regenerate salts and rotate passwords together.
- Never commit real salts to a public repository.
- Keep
wp-config.phpout of web-reachable backup dumps.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- wp-config.php wp-config.php holds database credentials, keys, and core WordPress settings for the site.
- Session hijacking Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- Assume breach Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- Incident response Incident response is the structured process of detecting, containing, cleaning, and learning from a security incident.