What are WordPress salts and how to change them?

[zayn_william]

Hello everyone,

I'm looking for insights and guidance on WordPress salts—what they are and how to change them. If anyone has knowledge on this topic, your assistance would be greatly appreciated.

[Ryaan J.]

WordPress salts and their associated security keys serve as essential cryptographic tools for enhancing the security of your WordPress website's login process. In particular, salts and security keys play a pivotal role in safeguarding the data stored within the cookies used by WordPress for user login sessions.

When you log in to your WordPress account, you can remain logged in, eliminating the need to enter your username and password repeatedly. To facilitate this seamless experience, WordPress stores your login credentials within cookies instead of relying on PHP sessions.

While users appreciate this convenience, it also introduces a potential security vulnerability if unauthorized individuals were to gain access to your browser's cookies.

To avoid this risk, WordPress employs salts and security keys to fortify the protection of your login information, rendering it impervious to malevolent actors seeking to exploit it.


Where are WordPress salts located?
By default, WordPress includes its set of salts and security keys stored in your website's wp-config.php file. In this file, you will find a total of eight keys:

• The initial four entries within this set are your security keys,
• while the subsequent four entries correspond to your WordPress salts.

How do WordPress salts work?
Imagine your WordPress site password is "password" (though it's a highly insecure choice, we'll use it for illustration).

When you log in, you provide your username and password. WordPress then saves this information in two browser cookies to keep you logged in (this data is also stored in your site's database).

However, if WordPress stores your password like "mypassword," it becomes vulnerable to being seen by malicious individuals. This is referred to as storing the password in plaintext, a severe security misstep.

Here's where security keys and salts come into play. They collaborate to cryptographically transform this plaintext password into a complex, seemingly random sequence of characters that is practically impossible to reverse engineer without access to your keys and salts.

Even though you entered "password" to log in, WordPress converts your password into something akin to "hsd78q34%7832$4jkhkjsfd78782^^429nsdf" for storage.

If someone possesses your salts and security keys, deciphering this seemingly random string into your password is a virtually impossible challenge.


How to Change WordPress salts?
Fresh WordPress installations are equipped with their predefined set of keys and salts, granting your WordPress site an inherent layer of security without requiring manual intervention.

Nonetheless, there are compelling reasons to contemplate periodic adjustments to your salts and keys. The fundamental idea behind this practice is to heighten the difficulty for malicious actors attempting to obtain your salts.

Furthermore, changing your salts results in an automatic logout of all currently logged-in users on your site, compelling them to log in anew. This presents an additional advantage. For instance, if you log in to a public computer and forget to log out, changing your password permits you to promptly force a logout for that account, ensuring that no unauthorized access can occur.

Method - 1. Manually Changing Your Keys

If you prefer, you can manually generate and update your SALT keys instead. To accomplish this, you'll utilize the WordPress SALT keys API to produce fresh keys for your website:

Step - 1: Log into your CPanel account.
Step - 2: Scroll down to Files and choose File Manager.



Step - 3: Inside the public_html root directory, search for the wp-config.php file.




Step - 4: Right-click and choose the Edit option.
Step - 5: Remove the existing keys from your wp-config.php file and substitute them by copying and pasting the keys generated from the WordPress.org salt generator.
Step - 6: Click on Save Changes.


Method - 2: Using plugin

Step - 1: Log into your WordPress Dashboard.
Step - 2: Scroll down to Plugins > Add New.
Step - 3: Search for the Salt Shaker plugin. This free WordPress plugin empowers you to automate the generation and change of WordPress salt keys.
Step - 4: Download and activate it.



Step - 5: Upon activating the plugin, head over to Tools > Salt Shaker, where you'll discover its settings:

Check the checkbox to enable the automated generation and change of SALT keys.

Once you've enabled the automatic SALT changes, the next step is to determine their frequency. From the drop-down menu, pick the interval at which you'd like the SALT keys to refresh:

Your choice of frequency should align with your website's specific requirements. You may opt for more frequent updates if your site deals with highly sensitive data. However, it's worth noting that daily changes are often regarded as excessive for most websites.