How to Change WordPress Security Keys and Salts

Applies to: WordPress 7.1 (wp-config.php), WP-CLI 2.12

WordPress uses eight secret values in wp-config.php, the security keys and salts (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and the four matching _SALT values), to protect login cookies. Changing them logs every user out at once. Do it after a hack, when a former admin or developer should lose access, or if your wp-config.php still contains put your unique phrase here.

With WP-CLI (quickest)

cd /path/to/wordpress
wp config shuffle-salts

It prints Success: Shuffled the salt keys. and writes eight new random values. We tested it with WP-CLI 2.12 on WordPress 7.1.2. On cPanel hosting, run it over SSH in public_html.

By hand

1. Back up wp-config.php.
2. Open WordPress’s official generator, https://api.wordpress.org/secret-key/1.1/salt/, which returns eight fresh lines each time you load it.
3. In wp-config.php (cPanel File Manager › Edit), replace the eight define( 'AUTH_KEY', ... to define( 'NONCE_SALT', ... lines with the new ones, and save.

What happens next

• Everyone, including you, has to log in again.
• Content, passwords and settings don’t change.
• Some plugins that encrypt data with the salts may need their settings re-entered; check your plugins after the change.

After a hack, also

• Change all admin passwords and the database password.
• Update WordPress, themes and plugins, and remove ones you don’t use.

More: password-protect the WordPress login and take a WordPress site offline or put it in maintenance mode.