Skip to content

Hardening

Security keys

Every planAbout Hardening

Changes the secret keys WordPress uses to sign people in. Every existing sign-in stops working at once, including any an attacker stole. Do it by hand, get reminders, or let Stack Guard do it on a schedule.

What it does

Your wp-config.php file holds eight long random keys, often called salts. WordPress uses them to sign the cookies that keep people signed in. New keys mean every old cookie is worthless.

The Key Rotation panel shows when the keys were last changed, when the next change or reminder is due, how many of the eight keys are properly set, and whether wp-config.php can be written.

Choose a Rotation schedule: Manual only, Remind me (an email on a schedule you pick), or Automatic (Stack Guard changes the keys daily, weekly or monthly at a set time).

Why it matters

After a break-in, a leaked backup or a departing developer, changing the keys is the fastest way to throw everyone out. Regular changes limit how long any stolen sign-in can last.

Change the keys now

  1. Go to the Hardening tab, section Security keys.
  2. Check the panel says wp-config.php is writable.
  3. Click Rotate Now and confirm. Everyone, including you, is signed out.
  4. Sign in again. Two-factor settings and your license keep working.

Good to know

Before writing, Stack Guard saves a copy of wp-config.php in wp-content/stack-guard-backups/ (the last 3 are kept) and checks the new file is valid.

Automatic changes sign everyone out at the chosen time, so pick a quiet hour such as 03:00. An email can tell you each time it happens.

If wp-config.php is not writable, ask your host, or use reminders and change the keys by hand.

Which plan includes it

Rotate Now and reminders are in every plan. Automatic rotation is part of Pro.

How it works, for developers
  • New keys come from api.wordpress.org/secret-key/1.1/salt/, or are generated locally if that fails. The eight define() lines are replaced, the result is checked as valid PHP, and the file is written in one step.
  • Two-factor secrets and the license key are encrypted again for the new AUTH_KEY. Rotation refuses to run if AUTH_KEY is not a plain quoted value, unless SMG_ENCRYPTION_KEY is defined.
  • "Keys set" counts keys that are defined, at least 32 characters long and not the sample text. The values are never shown.
  • Scheduled tasks: smg_scheduled_salt_change (automatic) and smg_salt_reminder, each booked one run at a time and rebuilt when the schedule settings change.
  • Settings: smg_salt_schedule_mode, smg_salt_auto_frequency, smg_salt_auto_day_of_week, smg_salt_auto_time, smg_salt_notify_on_auto, smg_salt_reminder_*; last change in smg_last_salt_change.

Quick answers about security keys

What does Security keys do in Stack Guard?

Your wp-config.php file holds eight long random keys, often called salts. WordPress uses them to sign the cookies that keep people signed in. New keys mean every old cookie is worthless. The Key Rotation panel shows when the keys were last changed, when the next change or reminder is due, how many of the eight keys are properly set, and whether wp-config.php can be written. Choose a Rotation schedule: Manual only, Remind me (an email on a schedule you pick), or Automatic (Stack Guard changes the keys daily, weekly or monthly at a set time).

Why use security keys on a WordPress site?

After a break-in, a leaked backup or a departing developer, changing the keys is the fastest way to throw everyone out. Regular changes limit how long any stolen sign-in can last.

How do I set up security keys?

1. Go to the Hardening tab, section Security keys. 2. Check the panel says wp-config.php is writable. 3. Click Rotate Now and confirm. Everyone, including you, is signed out. 4. Sign in again. Two-factor settings and your license keep working.

Which Stack Guard plan includes security keys?

Rotate Now and reminders are in every plan. Automatic rotation is part of Pro.

More in Hardening

Not running Stack Guard yet? It is free.

Download Free