All You Need To Know On the WordPress Unique Authentication Keys and Salts

Using unique WordPress authentication keys and sales is very important to ensure a more secure WordPress. Also known as the WordPress security keys, they are used by WordPress to ensure better encryption of information stored in a user’s cookies when logged in to a WordPress website or blog. They also have better support for when visiting the WordPress dashboard over SSL.

This article explains what the WordPress unique authentication keys and salts (WordPress security keys) are, how they work and how to configure them.

How are the Authentication Unique Keys and Salts Used?

Like with almost any other web application, when you login to WordPress it creates a number of cookies on your computer. Two of the cookies created are:

•  wordpress_[hash]
• wordpress_logged_in_[hash]

The first  cookie is used only in the admin pages (WordPress dashboard) while the second cookie is used throughout WordPress to determine if you are logged in to WordPress or not. Note: [hash] is a random hashed value typically assigned to your session, therefore in reality the cookies name would be something like wordpress_ffc02f68bc9926448e9222893b6c29a9.

WordPress stores your authentication details (i.e. WordPress username and password) in both of the above mentioned cookies. The authentication details are hashed, hence it is almost impossible for anyone to reverse the hash and guess your password through a cookie should it be stolen. By almost impossible it also means that with today’s computers it is practically unfeasible to do so.

The authentication details in these cookies are hashed using the random pattern specified in the WordPress security keys.

What are WordPress Security Keys and Salts?

WordPress security keys are made up of four authentication keys and four hashing salts (random data) that when used together they add an extra layer to your cookies and passwords. Below is a screenshot of already configured WordPress security keys in the wp-config.php file (do not use the below sample for your installation):

If the WordPress security keys are not yet configured, they look as per the below screenshot in the wp-config.php file:

A Little Bit of WordPress Security Keys History

There are 8 WordPress security keys but not all of them have been introduced at the same time. Below is a list highlighting when each of the key or salt has been introduced:

• WordPress 2.6: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY
• WordPress 2.7: NONCE_KEY
• WordPress 3.0: AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, NONCE_SALT

Configuring WordPress Security Keys

To configure the WordPress security keys in wp-config.php file, follow the below procedure:

1. Open the WordPress wp-config.php file
2. Search for Authentication Unique Keys and Salts. This section should be just after the database credentials unless you moved the database credentials out of your wp-config.php file.
3. Specify a random value of 60+ unique characters for each key and salt by replacing put your unique phrase here. You can use the online WordPress security key generator for automatic generation of the keys.
4. If you are using the online WordPress security key generator, simply copy the entire block of code and replace the eight default keys values in your wp-config.php file.
5. Save the wp-config.php file.

WordPress Authentication Unique Keys and Sales Notes

1. You do not need to remember the WordPress security keys values. You only configure them once in the wp-config.php file and can forget about them.
2. Any logged in users will need to login again to WordPress if the WordPress security keys are changed when they are logged in.
3. Never disclose your WordPress security to anyone or post them online.
4. WordPress security keys can be changed at any time.
5. The wp-config.php file is not modified when updating WordPress, hence you might have less security keys and salts in your wp-config.php file. If that should be the case you can safely specify the 8 new keys. Use the wp-config-sample.php file as a reference.

Improved WordPress Security

Configuring WordPress security keys is a very important step of securing your WordPress. Also should you ever doubt that your WordPress cookies have been stolen and your session is hijacked, change the WordPress security keys so the attacker’s cookies are invalidated and cannot be used to hijack your account.