How to rotate WordPress security keys and salts, and when to
To rotate WordPress security keys is to change the secrets that sign every sign-in session, so every session made with the old ones stops working. This guide explains what the keys and salts in wp-config.php do, how BetterShield’s Sign everyone out on demand strengthens them without editing that file, who is signed out when you apply or rotate, and when a rotation is worth doing.
Quick summary
- WordPress signs each session cookie with the keys and salts in wp-config.php. Anyone who holds them, and knows an account, can forge a session for it.
- Sign everyone out on demand mixes a strong secret of BetterShield’s own into every key WordPress derives. It does not edit wp-config.php, so a copy of that file alone is no longer enough.
- Rotate keys now replaces that secret. Every other session is signed out; from the dashboard, yours is kept. No password changes.
- Rotate after a suspected compromise, after someone with server or database access leaves, or on a schedule you choose.
- The audit’s Your site’s security keys are missing or weak (High) is a separate job: replacing the eight lines in the file. Both are worth doing.
What WordPress keys and salts do
wp-config.php holds eight lines: four keys and four salts, such as AUTH_KEY and AUTH_SALT. When you sign in, WordPress gives your browser a cookie, and signs it with values worked out from those lines. On every page you open, it checks the signature. A cookie it did not sign, or one signed with different keys, is refused.
That makes the keys the master secret for every session on the site. If they are left at the placeholder text a fresh wp-config.php ships with, or if a copy of wp-config.php has leaked through an old backup, a staging copy or a former contractor’s laptop, someone holding them can make a cookie the site will accept. Changing the keys turns every existing cookie, real or forged, into one the site refuses.
How BetterShield strengthens the keys
Sign everyone out on demand generates a strong secret and mixes it into every key WordPress derives, using the mechanism WordPress provides for exactly this. The secret is never shown, and wp-config.php is not edited. The keys in force become a combination of both, so forging a session needs the file and BetterShield’s secret together.
It is under Signing in on BetterShield › Protection › Login & Access, and it starts off.
Set it up
- Open BetterShield › Protection › Login & Access and find Sign everyone out on demand under Signing in. The note beside the switch says whose sessions will end.
- Pick a quiet time: everyone signed in will have to sign in again.
- Press Preview the change. Nothing changes.
- Turn the switch on. The row reads On since and Undo never expires, with the note “Every other session was signed out; yours was kept.”
Like every Signing in fix, applying it first checks that you have a way back in: a working recovery link or an unused printed code. If that check fails, you are offered Check now before you go ahead. See Set up recovery.
Rotate keys now
Once the fix is on, the row has Rotate keys now. Press it, read what it will do (“Generates a new secret. Every other session is signed out; yours is kept.”), and confirm. The row then reads Keys last rotated with the date and time.
A rotation has no undo: the previous secret is not kept anywhere. That is the point of it.
Who gets signed out
- Everyone else. Your other devices, your team, and on a store or membership site, every signed-in customer or member. Nothing is lost; they sign in again with the password they already have.
- Not you, from the dashboard. The browser you pressed the button in stays signed in. Applied from WP-CLI or by an AI assistant, there is no session to keep, so every session ends, yours included.
- Not tools on application passwords. Those are not sessions, so integrations using them carry on.
If the site uses a page cache, the note beside the switch says it may keep serving cached pages to signed-out visitors until it clears.
When to rotate
We recommend applying the fix on every single site, at a quiet hour, and rotating:
- After a suspected compromise. Rotating ends sessions, not passwords, so also change the password of any account you think was used.
- After someone with server or database access leaves, such as a developer or an agency you no longer work with.
- On a schedule you choose. Rotation is a button you press, so put it on your own calendar.
| Site | What we recommend |
|---|---|
| Store (WooCommerce) | Apply and rotate at your quietest hour: signed-in customers are signed out too. |
| Membership or course site | The same: every member is signed out. If you rotate on a schedule, tell members when. |
| Agency or many sites | Rotate on each client site when someone with server access leaves your team. |
The finding this does not close
The audit can report Your site’s security keys are missing or weak (High). That asks you to replace the eight lines in wp-config.php with a fresh set from the WordPress.org secret-key generator. Because BetterShield’s fix never edits wp-config.php, it never clears that finding. Do both: fresh lines in the file, and BetterShield’s secret on top. Neither does the other’s job.
Undo, and what undo cannot reach
To undo, turn the switch off. The keys go back to what wp-config.php alone gives, which is itself a change of key: every other session is signed out again, and yours is kept. Undo needs a signed-in browser, and your password if Ask for my password before an action that removes a protection is on under Settings › General.
Undo cannot bring back sessions that already ended, and a rotation cannot be put back.
Deactivating BetterShield while the fix is on also stops the secret being mixed in, which signs everybody else out. The Plugins screen says so before you do it.
Check it is working
- Another browser. One that was signed in before you applied or rotated is now signed out.
- The activity log. Applying is “Hardening applied”, rotating is “Authentication keys rotated”, and each is followed by “Sessions signed out” (Medium). See Activity log.
- Findings. While the fix is on, Some protections that are switched on are not working (Medium) names it if it reads as on but is no longer in force.
Frequently asked questions
Does rotating the keys change anyone’s password?
No. Rotating ends sessions. Everyone signs back in with the password they already have. After a suspected compromise, change the passwords of the accounts involved as well.
Do I need to edit wp-config.php?
Not for BetterShield’s fix, which mixes its own secret in and leaves the file alone. To clear Your site’s security keys are missing or weak, you do replace those eight lines in the file.
Can I rotate from WP-CLI?
wp bettershield harden auth_keys --user=<login> applies the fix from the terminal and signs every session out, yours included. Rotate keys now has no WP-CLI command. See WP-CLI commands.
How does this work on multisite?
One sign-in covers every site of a network, so the keys are shared. A network administrator rotates them from the Network screen in Network Admin, and every session on every site ends except theirs. See Multisite networks.
Conclusion
The keys in wp-config.php are the master secret behind every WordPress session. Fresh lines in the file deal with the placeholder text; BetterShield’s secret means a copy of the file alone is not enough; and Rotate keys now ends every session in one click when you need it to.
BetterShield is free on WordPress.org. The Rotate the sign-in keys doc covers every option, and Force logout all users covers the other ways to end sessions.