Recommended Free Tools
Generate a fresh set of WordPress security keys and salts with the official WordPress generator, then replace all eight corresponding define() lines in the active wp-config.php. If you have shell access, wp config shuffle-salts performs the same rotation from the WordPress installation directory. Replacing the values invalidates every existing authentication cookie, so all users—including administrators—must sign in again.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Back up the configuration first, make the change during a maintenance window, and protect the file and generated values as secrets. Rotation is useful after suspected disclosure or as part of hardening, but it does not update WordPress, repair vulnerable plugins, remove malware, or replace least-privilege access controls.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What WordPress security keys and salts are
WordPress keeps eight related constants in wp-config.php. Four are secret keys and four are salts:
| Constant | Role | WordPress guidance |
|---|---|---|
AUTH_KEY |
Random material used in authentication-related security calculations. | Required for enhanced security. |
SECURE_AUTH_KEY |
||
LOGGED_IN_KEY |
||
NONCE_KEY |
||
AUTH_SALT |
Additional random data mixed into generated authentication and nonce material. | Recommended and included by default. |
SECURE_AUTH_SALT |
||
LOGGED_IN_SALT |
||
NONCE_SALT |
Keys provide random elements for authentication material. Salts add further random data so the resulting values are harder to predict. They are configuration constants, not passwords that users type, and they are not stored in the WordPress database.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The values belong in the active configuration file, normally wp-config.php. A WordPress installation can load that file from the installation root or from a configured location one directory above it, so confirm the file actually used by the site before editing anything.
What changing the values does
WordPress uses these constants when it creates and validates authentication cookies and related nonce material. When you replace them, cookies made with the old values no longer validate. WordPress’s core sample file states: “You can change these at any point in time to invalidate all existing cookies.”
That means a rotation is an intentional global sign-out:
- Every logged-in browser session expires, including your own administrator session.
- Users must authenticate again on their next request.
- Applications or integrations that rely on WordPress login cookies may need a fresh sign-in or token flow.
- Visitors who were not logged in do not need to do anything.
Schedule the change when support staff can answer login questions and when a mass reauthentication will not interrupt a deployment, live event, or other time-sensitive operation.
Before you rotate: a safe checklist
- Identify the live configuration. Confirm the site, environment, installation directory, and the exact
wp-config.phppath loaded by the running application. This is especially important for multisite, containers, symbolic links, and hosting layouts that keep configuration above the document root. - Make a tested backup. Copy the current file to a protected location and verify that you can restore it. A backup that has never been tested is not a rollback plan.
- Record the operational impact. Notify administrators, editors, support staff, and anyone responsible for integrations that all current sessions will be invalidated.
- Check how the file is managed. If a deployment system, container image, infrastructure template, or secret store generates
wp-config.php, plan to update that source as well as the live file. Otherwise the next release or restart can put the old values back. - Choose a controlled window. Have an administrator session ready to test, but expect that session to end when the file changes.
- Protect the material. Do not paste generated values into tickets, screenshots, public repositories, chat rooms, or other places where people who should not administer the site can read them.
Method 1: use the official WordPress secret-key generator
The browser method works when you can edit the configuration file but do not have command-line access. Use the official service referenced by WordPress’s core sample file: https://api.wordpress.org/secret-key/1.1/salt/. It returns a complete replacement block containing all eight constants.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Step 1: open the generator
Open the URL directly and generate a new set. Do not copy the example values shown in WordPress documentation or reuse a set from another site. Each installation should have its own unpredictable values.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteStep 2: open the active configuration file
Use your hosting file manager, secure file-transfer method, or server editor to open the wp-config.php that the running site loads. Keep the backup available in a separate protected location. Do not edit a sample file, an old release directory, or a staging copy by mistake.
Step 3: replace the complete eight-line block
Find the existing definitions for AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, and NONCE_SALT. Replace those definitions with the generated lines as a group.
Preserve the PHP syntax exactly: each line needs its constant name, quoted value, closing parenthesis, and semicolon. Do not add smart quotes, remove quotation marks, alter commas, or leave a duplicate definition elsewhere in the file. The generated values themselves are the secret; do not modify them for readability.
Step 4: save and validate
Save the file without changing unrelated settings. Confirm that the site’s front end responds, the administrator login page loads, and critical integrations still operate. The first administrator test will normally require a new login because the previous cookie was deliberately invalidated.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Step 5: tell users to authenticate again
Communicate the forced sign-out through the channel your users normally trust. Explain that the logout is an expected result of the security change, not necessarily evidence that each user’s password was compromised.
Method 2: rotate with WP-CLI
WP-CLI is preferable when you administer servers by shell, repeat the operation across environments, or need a command that can be recorded in an operational runbook. From the WordPress installation directory, run:
wp config shuffle-saltsThe command refreshes the salts and keys in wp-config.php. It updates the same eight constants as the browser-generated block; it does not create a different type of credential or change the WordPress database.
Verify the path and configuration
WP-CLI provides these related commands:
wp config pathhelps identify the configuration path WP-CLI is using.wp config listlists configuration entries for inspection.wp config getretrieves a specified configuration value.
Use inspection commands carefully. A command that prints secret values can place them in terminal scrollback, CI logs, shell history, or monitoring output. Restrict access to those records and avoid publishing command output. The goal is to verify that the intended file changed, not to distribute the generated strings.
Run the command safely
- Change to the directory for the target WordPress installation.
- Confirm that the shell user has permission to read and write the active configuration file.
- Make and verify the backup described earlier.
- Run
wp config shuffle-salts. - Check the command result and the file timestamp or version-control change, without exposing the values.
- Open the site and login endpoint, then perform the post-change checks during the maintenance window.
If your deployment process generates the file, commit or otherwise update the template or secret store that owns the values. Treat the live edit as incomplete if an automated release is guaranteed to overwrite it.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Browser generator or WP-CLI? Choose by operational access
| Consideration | Official browser generator | wp config shuffle-salts |
|---|---|---|
| Required access | Access to the official generator and a secure way to edit the active file. | Shell access, WP-CLI, and write permission for the installation’s configuration. |
| Repeatability | Manual replacement of the generated block for each site. | One documented command can be repeated in a controlled runbook. |
| Auditability | Relies on your file-change record and backup procedure. | Fits shell history, change management, and deployment logs, provided secret output is excluded. |
| Automation | Not a good fit for unattended rotations because it requires handling generated text. | Can be incorporated into an administrative workflow after you design safe backup, approval, and secret-handling steps. |
| Rollback | Restore the protected backup if the edited PHP fails to parse. | Use the same backup and rollback plan; the command does not remove the need for one. |
| Result | Both methods replace the same eight constants and invalidate existing cookies. | |
Protecting wp-config.php and the generated values
wp-config.php can contain database credentials and other sensitive settings in addition to the keys and salts. The WordPress hardening guidance allows the file to live one directory above the installation and generally recommends that it be readable only by the owner and the web server. Apply the narrowest file and directory permissions that your hosting model supports.
Also configure the web server so requests for the configuration file are denied rather than served as source text. The exact rule depends on the server and hosting stack, so test the rule against the site’s normal requests and never assume that a downloaded PHP file will be executed safely in every failure mode.
- Keep the file out of public repositories and unencrypted support attachments.
- Limit shell, file-transfer, and hosting-panel access to the people and service accounts that need it.
- Redact all eight values from screenshots, logs, tickets, and incident reports.
- When copying a site, generate an independent set for the destination instead of cloning production values into staging or another customer installation.
Anyone who obtains the values may be able to interfere with session security. Protect them like other application secrets even though they are not user passwords.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →When rotation is the right response
Suspected disclosure
If the configuration file, a backup, a repository, a log, or a support conversation may have exposed the values, rotating them is a practical way to invalidate cookies made with the exposed material. Change access controls and investigate the exposure at the same time; rotation alone does not explain how the values leaked.
Routine hardening
Rotation can be one task in a broader hardening plan, particularly when ownership or administrative access has changed. Establish an approved procedure, a backup location, a maintenance window, and a communication plan rather than changing production files casually.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
What rotation cannot fix
New values do not patch a vulnerable WordPress core, theme, or plugin. They do not remove malware, repair altered files, close an exposed administrator account, or enforce least-privilege permissions. If there is evidence of compromise, preserve relevant evidence and address the underlying weakness instead of treating a global logout as a complete remediation.
Troubleshooting after a change
The site shows a PHP parse error or a blank page
Restore the tested backup immediately to recover service. Then compare the edited block with the generated output and check for missing quotation marks, commas, semicolons, or PHP delimiters. A copied smart quote or an accidentally deleted character can make an otherwise valid configuration fail to parse. Reapply the replacement only after the syntax has been checked and the maintenance window is still controlled.
Users are unexpectedly logged out
That is the intended effect of changing the values. Confirm that the file change was approved and that the new login works. If the logout was not planned, check deployment history and automated configuration management for an unannounced rewrite of the file, then determine which values are now authoritative before making another change.
The old values return after a deployment or restart
Update the template, image, environment secret, or configuration-management source that recreates wp-config.php. Editing only the generated live file leaves the older source unchanged, so the next release can restore the previous set and trigger another session invalidation.
The command changes the wrong site
Stop and verify the working directory, the value returned by wp config path, the container or host identity, and the multisite environment. Make sure the configuration path belongs to the site you intended before running the command again.
Some integrations stop working
First complete a normal browser login and test the integration’s documented authentication flow. Services that depended on a WordPress login cookie may need to establish a new session. Do not weaken the new keys or copy the old values back merely to avoid reauthentication.
Free tools Windows power users keep installed
One-click scans. No signup required.
Post-rotation verification
Use a short, repeatable checklist so the forced sign-out does not hide an unrelated failure:
- Load the public home page and at least one representative content page.
- Open the administrator login page and authenticate with an authorized account.
- Check that an administrator can reach the dashboard and perform a harmless read-only task.
- Test the site’s critical integrations, forms, and scheduled operational workflows.
- Confirm that users and support staff received the reauthentication notice.
- Record which environment and configuration path changed, when it changed, who approved it, and where the protected rollback copy is stored. Do not record the secret strings themselves.
How often should you change WordPress salts?
There is no interval in the supplied WordPress guidance that requires routine rotation on a fixed calendar. Change them when you have a security reason, such as suspected disclosure or a controlled change of administrative ownership, and include the operation in a wider hardening process. Any schedule you adopt should account for the unavoidable global sign-out, backup and rollback testing, deployment templates, and user communication.
Quick Recap
Key takeaways
- WordPress uses
AUTH_KEY,SECURE_AUTH_KEY,LOGGED_IN_KEY,NONCE_KEY,AUTH_SALT,SECURE_AUTH_SALT,LOGGED_IN_SALT, andNONCE_SALTinwp-config.php. - Generate replacements from the official service at https://api.wordpress.org/secret-key/1.1/salt/, or run
wp config shuffle-saltsfrom the correct installation directory. - Back up and verify the active configuration before editing, then protect both the file and its values.
- Expect all existing login cookies to become invalid and plan for every user to sign in again.
- Rotation strengthens session invalidation but is not a substitute for updates, malware cleanup, or access-control work.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
