Rotate wp-config.php Salts After a Hack

Generate live WordPress.org keys, paste the eight defines, expect a full logout, then lock down wp-config.php permissions.

24 August 2026 By Tools.Town Team 5 min read

Stolen cookies or a suspicious wp-config.php. Rotate keys, then keep cleaning.

Generate with the Salt Generator (never cached).
Replace the eight define() lines. Save. Everyone is logged out.
Set wp-config.php to 600 (or 640 if the host needs group read) via the Chmod Calculator and file permissions use-case.
Reset passwords and scan files. Salts are not antivirus.

Frequently Asked Questions

Is rotating salts enough after malware?

No. Salts only invalidate cookies. You still need a clean filesystem, new passwords, and a review of users and cron.