--- title: "What are WordPress salts and security keys? | WP Ministry" url: https://wpministry.co/glossary/salts-and-security-keys/ description: "WordPress salts and security keys are eight long random strings in wp-config.php, used to make login cookies and form tokens. Replacing them logs users out." lang: en-US --- Skip to content # Salts and security keys WordPress salts and security keys are eight long random strings in wp-config.php. WordPress uses them to make the login cookies and form tokens it hands out. Replace them and everyone who is logged in has to log in again. By WP Ministry Published October 8, 2026 ## In short - The eight lines run from AUTH_KEY to NONCE_SALT in wp-config.php. Each one should be long, random and different from the rest. - Replacing them logs everyone out at once. It changes no password and revokes no application password. - Replace them when you need every login session ended, such as after a break-in. WordPress salts and security keys are eight constants in `wp-config.php`: four keys and four salts, each a long random string. WordPress mixes them into the login cookies and the form tokens it hands out, and uses them again to check each one that comes back. Replace them and every cookie already issued fails that check, so every user has to log in again. Nobody types them. WordPress's documentation says you do not have to remember them, only make them long, random and complicated. ## Where you meet it In `wp-config.php`, in the folder WordPress is installed in, as eight lines: wp-config.php ``` define( 'AUTH_KEY', 'put your unique phrase here' ); define( 'SECURE_AUTH_KEY', 'put your unique phrase here' ); define( 'LOGGED_IN_KEY', 'put your unique phrase here' ); define( 'NONCE_KEY', 'put your unique phrase here' ); define( 'AUTH_SALT', 'put your unique phrase here' ); define( 'SECURE_AUTH_SALT', 'put your unique phrase here' ); define( 'LOGGED_IN_SALT', 'put your unique phrase here' ); define( 'NONCE_SALT', 'put your unique phrase here' ); ``` That is how WordPress's sample file ships them. On a working site each line holds a long random string in place of the phrase. The names come in four pairs, a key and a salt each. `AUTH` and `SECURE_AUTH` are for the dashboard's cookie, over plain HTTP and over HTTPS. `LOGGED_IN` is for the cookie that says who you are on the rest of the site. `NONCE` is for the tokens in forms and links: see nonce (https://wpministry.co/glossary/nonce/). A line that is missing, still reads "put your unique phrase here", or has the same value as another line is not used. WordPress makes a value of its own for it and keeps that in the database. WordPress.org runs a service that returns eight fresh lines of 64 characters each. The salt and security key generator (https://wpministry.co/tools/wordpress-salt-generator/) makes them in your browser, and the wp-config.php generator (https://wpministry.co/tools/wp-config-generator/) builds a whole file with new ones in it. ## What goes wrong - **Everyone is logged out at the same moment, or over and over.** Something replaced the keys: a plugin that rotates them, a deployment that writes a new `wp-config.php`, or two servers behind one address that hold different keys. How to fix WordPress when it keeps logging you out (https://wpministry.co/errors/wordpress-keeps-logging-out/) has the check for each. - **A form that was open says "The link you followed has expired."** New keys make new tokens, so a page opened before the change holds old ones. Reload it. That message has its own page (https://wpministry.co/errors/are-you-sure-you-want-to-do-this/). - **The keys were replaced after a break-in, and the intruder is still in.** New keys end sessions. They do not change a password, and an application password goes on working until it is revoked. Removing malware from a hacked site (https://wpministry.co/blog/remove-malware-hacked-wordpress-site/) and dealing with an unknown admin user (https://wpministry.co/blog/unknown-admin-user-wordpress/) put the keys in order with the other steps. ## How to look at yours Open `wp-config.php` and find the eight lines. To replace them, paste eight new lines over the old ones. With WP-CLI, one command does it. It ends every login session on the site, yours included. bash ``` wp config shuffle-salts ``` It answers `Success: Shuffled the salt keys.` ## Common questions Will changing the salts break my site? No. Content, settings and passwords stay as they are. Every user is sent to the login screen once and logs in with the same password as before. A dashboard page left open in a browser needs reloading before its forms work again. How often should I change them? WordPress's documentation sets no schedule. It says you can change them at any time to invalidate all existing cookies. Change them when that is what you need: after a break-in, or when someone who should not have a copy of `wp-config.php` has seen it. What is the difference between a key and a salt? In use, very little. WordPress joins each key to its salt and uses the two as one secret. Its documentation calls the four keys required and the four salts recommended, because WordPress generates a salt when none is given. Treat all eight the same way. ## Not sure what is wrong? Tell us what you see. We reply with the cause and a fixed quote, and the diagnosis is free. Get a free diagnosis: https://wpministry.co/free-diagnosis/ May we measure how this site is used? A yes notes the pages of this visit and loads Google Analytics. A no keeps and loads nothing. See the cookies page (https://wpministry.co/legal/cookies/). If you say yes, we note the pages you look at during this visit and load Google Analytics. If you say no, nothing is kept and nothing is loaded. The site works the same either way. The cookies page (https://wpministry.co/legal/cookies/) has the details. ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://wpministry.co/#organization", "name": "WP Ministry", "url": "https://wpministry.co/", "logo": "https://wpministry.co/brand/logo.png", "address": { "@type": "PostalAddress", "streetAddress": "1309 Coffeen Ave STE 1200", "addressLocality": "Sheridan", "addressRegion": "WY", "postalCode": "82801", "addressCountry": "US" }, "sameAs": [ "https://www.linkedin.com/company/wp-ministry/", "https://x.com/wpministryco", "https://www.instagram.com/wpministryco/", "https://www.facebook.com/wpministryco", "https://www.tiktok.com/@wpministryco", "https://www.pinterest.com/wpministryco/", "https://www.youtube.com/channel/UCOZRuAukk5QSTRPG6BaHl3Q" ] }, { "@type": "WebSite", "@id": "https://wpministry.co/#website", "name": "WP Ministry", "url": "https://wpministry.co/", "inLanguage": "en-US", "publisher": { "@id": "https://wpministry.co/#organization" } }, { "@type": "DefinedTerm", "@id": "https://wpministry.co/glossary/salts-and-security-keys/#term", "name": "Salts and security keys", "description": "WordPress salts and security keys are eight long random strings in wp-config.php, used to make login cookies and form tokens. Replacing them logs users out.", "url": "https://wpministry.co/glossary/salts-and-security-keys/", "inDefinedTermSet": "https://wpministry.co/glossary/" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://wpministry.co/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://wpministry.co/glossary/" }, { "@type": "ListItem", "position": 3, "name": "Salts and security keys" } ] } ] } ```