How to Regenerate WordPress Salts and Security Keys

Every WordPress site has eight random strings in wp-config.php: the security keys and salts. Most people never look at them. They matter the day something goes wrong, because changing them is the fastest way to log everyone out and make stolen login cookies useless.

What salts and keys do

When you log in, WordPress gives your browser a cookie that proves who you are. That cookie is signed with the keys and salts in wp-config.php. As long as they don’t change, the cookie stays valid.

Change them, and every existing login cookie stops working immediately. Every user is logged out, including anyone who stole a cookie. Passwords aren’t affected: people simply log in again.

Here’s what the block looks like in wp-config.php:

define( 'AUTH_KEY',         'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
define( 'NONCE_KEY',        'put your unique phrase here' );
define( 'AUTH_SALT',        'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
define( 'NONCE_SALT',       'put your unique phrase here' );

When to regenerate them

• After a hack or suspected break-in, as part of the cleanup, together with changing passwords.
• When someone leaves who had admin access (a former employee or agency).
• If they’re still the placeholders above, or look short and simple.
• When you migrate a site that shared its wp-config.php with a staging copy.

Option 1: regenerate by hand

1. Open WordPress’s official generator: api.wordpress.org/secret-key/1.1/salt. It returns eight fresh lines every time you load it. Never use example values from a tutorial.
2. Back up wp-config.php.
3. Open it (via SFTP or your host’s file manager) and replace the eight define(...) lines with the new ones.
4. Save. You’ll be logged out; log in again.

If you use WP-CLI, one command does it:

wp config shuffle-salts

Option 2: one click with DevKit

DevKit has a Generate WP Salt button at the bottom of its Settings page. It writes fresh keys and salts to wp-config.php for you, with no file editing and no FTP. It’s the same result as doing it by hand, in one click, which is exactly what you want in the middle of a cleanup.

After regenerating

• Log in again and check that the site works.
• Tell your team they’ll need to log in again.
• If the change is part of a hack cleanup, also: update all passwords, remove unknown admin users, update WordPress and plugins, and scan the files.