Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
WordPress security keys and salts are eight random values in wp-config.php: four keys and four salts used to strengthen authentication cookies and nonce data. Generate replacements with the official WordPress service at https://api.wordpress.org/secret-key/1.1/salt/, or rotate them from the server with wp config shuffle-salts.
Replacing the values immediately invalidates existing authentication cookies, so every user—including administrators—must sign in again. Make a restorable backup, edit the configuration file that the running site actually loads, and keep the resulting values private.
Free tools Windows power users keep installed
One-click scans. No signup required.
What WordPress security keys and salts do
WordPress stores eight constants in wp-config.php. The four keys provide the enhanced-security portion of the authentication system; the four salts add further random data to generated authentication and nonce material. A normal WordPress configuration includes all eight.
| Constant | Type | Purpose in the configuration |
|---|---|---|
AUTH_KEY |
Key | Random input for authentication-related data. |
SECURE_AUTH_KEY |
Key | Random input for secure authentication data. |
LOGGED_IN_KEY |
Key | Random input for logged-in user authentication data. |
NONCE_KEY |
Key | Random input used when WordPress creates nonce material. |
AUTH_SALT |
Salt | Additional random data for authentication results. |
SECURE_AUTH_SALT |
Salt | Additional random data for secure authentication results. |
LOGGED_IN_SALT |
Salt | Additional random data for logged-in user results. |
NONCE_SALT |
Salt | Additional random data for nonce results. |
They are not passwords that users type. They are server-side secrets incorporated into values that WordPress checks when handling sessions and request-protection tokens. Anyone who obtains the values gains information that should remain confined to the site configuration, so treat them like other production secrets.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
When to generate or rotate them
Generate a complete set when creating a configuration that lacks these constants. Rotate the set when the file may have been copied, exposed, committed to a public repository, included in a support ticket, or read by an unauthorized account. Rotation is also a practical way to terminate all existing browser sessions after a suspected disclosure.
There is no need to change values merely because a calendar interval has elapsed. The important triggers are a suspected exposure, an administrative security response, or a controlled maintenance operation. A rotation is disruptive because it expires every current login at once, including sessions used by administrators, editors, application integrations, and background tools that rely on WordPress authentication cookies.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Prepare safely before changing wp-config.php
- Make and test a backup. Copy the current
wp-config.phpto a protected location and verify that the copy can be restored. Do not place the backup in a publicly served directory or a public source-control repository. - Identify the active configuration. In a conventional installation it is in the WordPress installation root. WordPress can also load it from one directory above that root. Multisite, container, and deployment layouts may have a generated or mounted file instead, so confirm which file the running PHP process reads.
- Plan a maintenance window. Existing sessions will stop working when the new values take effect. Warn users, schedule the change when sign-ins are least disruptive, and keep an administrator session or console access available for verification.
- Secure your editing path. Use an administrative shell or a protected file-transfer/editor account. Never paste the values into a chat room, issue tracker, screenshot, ticket, or public repository.
- Check for configuration management. If a deployment system, container image, environment template, or secret store creates
wp-config.php, plan to update that source as well as the live file. Otherwise a later deployment can silently restore the old values.
Method 1: Generate a new set with the official WordPress service
This method is suitable when you have secure access to edit the file but do not use WP-CLI. The official service returns a complete set of replacement definitions. Use the service itself rather than copying sample values from a tutorial or documentation page; examples are not unique secrets.
- Open https://api.wordpress.org/secret-key/1.1/salt/ in a browser. It returns fresh definitions for all eight constants.
- Copy the generated definitions directly from the response. Do not edit the random strings, substitute memorable text, or reuse a set from another installation.
- Open the active
wp-config.phpidentified during preparation. Find the existing definitions forAUTH_KEY,SECURE_AUTH_KEY,LOGGED_IN_KEY,NONCE_KEY,AUTH_SALT,SECURE_AUTH_SALT,LOGGED_IN_SALT, andNONCE_SALT. - Replace all eight old
define()lines with the generated lines. Keep every constant name exactly as supplied, and preserve PHP quotes, commas, parentheses, and the surrounding PHP delimiters. - Save the file using the restrictive ownership and permissions used for the rest of the production configuration. Do not leave a second copy in the web root.
- Load the public site, open the administrator login, and test one critical integration. If the browser presents a parse error or the site returns a server error, restore the tested backup immediately and inspect the edited lines.
- Notify users that they must sign in again. A successful change is expected to invalidate the previous cookies; it is not evidence that the site has failed.
The core sample file states: “You can change these at any point in time to invalidate all existing cookies.” That behavior is the reason to rotate deliberately rather than treating the edit as a harmless configuration refresh.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Method 2: Rotate them with WP-CLI
WP-CLI is the better fit for repeatable server work, scripted incident response, and deployments where shell access is already controlled. Run the command from the WordPress installation directory or supply the appropriate path through your normal WP-CLI mechanism.
wp config shuffle-saltsThe command refreshes the salts in wp-config.php; in normal configurations it updates the complete key-and-salt set used by WordPress. It changes the same file and the same eight constants as the browser method, so the session consequences are identical.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inspect the configuration after the command
WP-CLI provides related commands for checking which configuration is being used:
wp config path
wp config list
wp config get AUTH_KEYwp config pathhelps confirm the file location selected by WP-CLI.wp config listlists configuration entries so you can check that the expected constants exist.wp config get AUTH_KEYreads a single value for verification. Run value-inspection commands only in a terminal session that is not being recorded or shared, and avoid placing their output in logs.
Before automating the command, arrange a backup and define how the job will report failure. A script that exits after changing the file but before a health check can leave operators unsure whether the rotation completed. Keep the generated secrets out of command transcripts and continuous-integration output.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Browser generator or WP-CLI: which method fits?
| Decision factor | Official browser generator | wp config shuffle-salts |
|---|---|---|
| Access required | Secure browser access plus a way to edit the active file. | Shell access with WP-CLI available in the WordPress environment. |
| Repeatability | Manual copy and replacement for each operation. | One documented command that can be repeated consistently. |
| Automation | Not convenient for unattended jobs. | Suitable for controlled scripts and incident runbooks. |
| Auditability | Record the operator and change through your change-management system without recording secret values. | Shell history and job logs can show the command, but must be configured so values are never printed. |
| Rollback | Restore the protected backup if the edit breaks PHP. | Restore the pre-command file or deployment artifact if the command or follow-up check fails. |
| Result | Both methods replace the eight constants in the active wp-config.php and invalidate existing cookies. |
|
Choose the browser method for a one-off, manually supervised change when shell access is unavailable. Choose WP-CLI when the site is managed through a terminal, when several environments must be handled consistently, or when the operation belongs in a documented response procedure.
What users and integrations experience after rotation
WordPress will no longer accept cookies created with the previous key-and-salt material. Every user must authenticate again, not only the account that performed the change. Administrators should expect their current dashboard session to end and should keep the new login route available before starting the operation.
- Users see a login prompt the next time they request a page that requires authentication.
- Open administrative tabs may return to the login screen or require a refresh after sign-in.
- Nonce-backed forms and requests created before the rotation may need to be reloaded so that WordPress can issue fresh values.
- Services that depend on WordPress login cookies may need to establish a new session. Test the site’s critical integrations rather than assuming that every client handles expiration identically.
Rotation does not change user passwords, repair vulnerable code, update WordPress or plugins, remove malware, or correct excessive file and account permissions. It is a session-secret response, not a complete security program. If a disclosure is suspected, investigate how the values were exposed and address that access path as well.
Protect the file that contains the secrets
The WordPress hardening guidance permits wp-config.php to live one directory above the public WordPress installation, where the web server cannot serve it as a normal document. Whether or not that layout is possible on your host, the file should generally be readable only by its owner and the web-server process that must load it.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Set ownership and permissions according to the hosting platform’s least-privilege model. Avoid world-readable permissions.
- Use server rules that deny web requests for
wp-config.phpif a request reaches the public document tree. - Check backups, deployment artifacts, container layers, and diagnostic bundles; a protected live file is not enough if an old copy is publicly accessible elsewhere.
- Keep the generated strings out of screenshots, support tickets, chat logs, public repositories, and unredacted error reports.
- Restrict shell, file-transfer, and hosting-panel accounts that can read the file. A secret is not protected if every operational account can retrieve it.
Troubleshoot common failures
A PHP parse error appears immediately
Restore the known-good backup first so the site can serve pages again. Then compare the replacement lines character by character. The usual causes are a missing quote, comma, parenthesis, PHP delimiter, or an accidental line break inside a generated value. Reapply the generator output without retyping the random strings and test in a staging environment when available.
The site works, but the old login remains in one browser
That browser may be displaying a cached page or may not yet have requested an authenticated resource. Open a new private window, visit the login page, and authenticate with a current account. Do not conclude that rotation failed because a public, cached page still renders.
A deployment brings the old values back
Find the template, environment variable, secret manager entry, or image layer that creates wp-config.php. Update that source and redeploy through the normal process. Editing only the live file is temporary when infrastructure management owns the configuration.
WP-CLI changed a different file than the web server uses
Compare wp config path with the path loaded by the running application. Containers, multisite layouts, symbolic links, and a configuration file above the installation directory can make a shell command and the web process select different files. Correct the target before running another rotation.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
An integration stops working after the change
First establish a new authenticated session in the integration and inspect its documented login or token-refresh procedure. If the client stores a WordPress cookie, it must obtain a replacement. If it uses an independent credential, investigate the integration separately; rotating these constants does not rotate unrelated API keys or passwords.
Users are surprised by simultaneous sign-outs
That result is expected. Schedule future rotations in a maintenance window, communicate the sign-in requirement in advance, and verify that at least one administrator can log in after the file is saved. For an emergency disclosure, the security benefit of ending sessions may outweigh the interruption, but record the decision and follow up with the broader investigation.
A practical rotation checklist
- Confirm why the rotation is needed and who must be notified.
- Back up the active configuration and verify restoration.
- Confirm the actual file path, especially for multisite, containers, and managed deployments.
- Use the official generator or run
wp config shuffle-saltsfrom the correct installation. - Replace or refresh all eight constants together; do not mix values from separate sets.
- Preserve valid PHP syntax and restrictive file permissions.
- Check the public site, administrator login, and critical authenticated integration.
- Tell users to sign in again and refresh forms that were open during the change.
- Update templates and secret stores so a later deployment cannot restore the previous set.
- Record the change without recording the secret values.
How key-and-salt rotation fits broader WordPress hardening
Changing these constants is most valuable when you have a reason to invalidate sessions or suspect that configuration secrets escaped. It should sit alongside timely WordPress and plugin updates, malware investigation when indicated, strong individual accounts, least-privilege file access, protected backups, and server rules that prevent configuration disclosure. None of those controls is replaced by a salt rotation, and a rotation cannot make a vulnerable plugin safe.
For a routine operation, the safest pattern is simple: use a unique generated set, change all eight values in the configuration source that actually controls production, verify the application, and treat the resulting sign-outs as an intentional security event. For an incident, preserve relevant logs and investigate the exposure before deciding whether additional credentials or access permissions also need to be revoked.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
