If your WordPress site was hacked, rotating security salts is one of the fastest ways to invalidate stolen login sessions and reduce further access.
This guide explains how to rotate WordPress salts after hack incidents, what they do, and the exact steps to update them safely.
What WordPress salts do
WordPress salts are cryptographic values stored in wp-config.php that help secure authentication cookies, nonces, and session data.
They work together with keys to make stolen cookies harder to reuse, which is why they matter during incident response.
When attackers obtain valid cookies from a compromised browser, old sessions may remain active until the authentication data changes.
Updating salts forces WordPress to treat existing login cookies as invalid, which can log out users and administrators across the site.
When should you rotate WordPress salts after a hack?
Rotate salts immediately if you suspect any of the following:
- Unauthorized administrator logins
- Malware or injected PHP files
- Suspicious plugin or theme changes
- Stolen credentials or leaked session cookies
- Unknown users appearing in the WordPress admin area
Salt rotation is not a full cleanup by itself.
It is one containment step that should be paired with malware removal, password resets, and a review of user accounts, plugins, and file integrity.
How to rotate WordPress salts after hack
The most reliable method is to replace the existing security keys and salts in wp-config.php with fresh values from the WordPress secret-key generator.
1. Back up the site first
Before making any security changes, create a backup of both the database and files.
If something goes wrong, you will need a way to restore the site quickly.
- Export the database through your host or a tool like phpMyAdmin
- Download the full WordPress files via SFTP or your hosting panel
- Record current configuration changes in
wp-config.php
2. Open wp-config.php
Connect to your site using SFTP, SSH, or your hosting file manager.
In the WordPress root directory, locate wp-config.php and open it in a plain-text editor.
Find the section that looks like this:
define('AUTH_KEY', 'old-value');
define('SECURE_AUTH_KEY', 'old-value');
define('LOGGED_IN_KEY', 'old-value');
define('NONCE_KEY', 'old-value');
define('AUTH_SALT', 'old-value');
define('SECURE_AUTH_SALT', 'old-value');
define('LOGGED_IN_SALT', 'old-value');
define('NONCE_SALT', 'old-value');3.
Replace the old values with fresh salts
Use the official WordPress secret-key service to generate new values.
Replace every existing key and salt line with the newly generated ones.
You can obtain fresh values from:
https://api.wordpress.org/secret-key/1.1/salt/
Copy the output exactly as provided.
Each line should remain in the same format, but the values must be new and unique.
4. Save and upload the file
After replacing the old salts, save the file and upload it back to the server if needed.
Once the new file is live, WordPress will invalidate existing authentication cookies.
This typically logs out all users, including administrators, editors, and subscribers.
That is expected and desirable after a compromise.
What happens after you rotate the salts?
Once salts change, WordPress can no longer validate old session cookies.
Users must log in again, and any attacker relying on stolen cookie data will usually lose access.
Keep in mind that rotating salts does not remove malicious code, restore deleted content, or fix backdoors.
If malware is still present, an attacker may regain access through another route such as a compromised plugin, vulnerable theme, or stolen admin password.
What else should you do after a hack?
Salt rotation should be part of a broader incident response plan.
A thorough cleanup often includes these actions:
- Change all WordPress administrator passwords
- Reset hosting, FTP, SSH, and database passwords
- Review the user list for unknown accounts
- Delete inactive or nulled plugins and themes
- Update WordPress core, plugins, and themes
- Scan for malware and backdoors
- Check
.htaccess,wp-config.php, and core files for suspicious edits
If you use a security plugin such as Wordfence, Sucuri, or iThemes Security, run a full scan after the salts are changed.
Hosting providers may also provide file integrity monitoring and malware cleanup tools.
Best practices to avoid another compromise
After recovery, tighten your defenses so you are not forced to repeat the process.
Good WordPress security depends on layered controls, not a single setting.
Use a strong password policy
Enforce unique passwords for every account and use a password manager.
Reused credentials remain one of the most common ways sites are compromised.
Enable two-factor authentication
Two-factor authentication adds a second verification step for admin logins.
Even if a password is stolen, the attacker still needs the second factor to sign in.
Limit administrator access
Only assign administrator roles to people who truly need them.
Reduce the number of privileged accounts and remove any stale users immediately.
Keep WordPress updated
Outdated plugins, themes, and core files often contain known vulnerabilities.
Security updates close common attack paths before they are exploited.
Harden file and login security
Restrict file permissions, disable direct editing of theme and plugin files, and consider limiting login attempts.
These measures make brute-force and file-injection attacks harder.
Common mistakes to avoid when rotating salts
Several avoidable errors can weaken your response or create confusion during recovery:
- Changing only one salt instead of all eight values
- Forgetting that all users will be logged out
- Skipping password resets after the incident
- Assuming salt rotation removes malware
- Editing the wrong
wp-config.phpfile on a multi-site or staged setup
If your site uses a content delivery network, object cache, or managed WordPress platform, verify whether cached authentication data needs to be cleared as part of the recovery process.
How to verify the rotation worked
After saving the new salts, open your site in a browser where you were previously logged in.
You should be prompted to sign in again.
If you remain logged in unexpectedly, check whether the correct environment file was edited and confirm that the new values were deployed to production.
Also review the activity log, if available, for repeated logins, failed authentication attempts, or new admin accounts.
Evidence of repeated access attempts may indicate that additional cleanup is needed.
When to get professional help
If the site has repeated reinfections, suspicious database changes, or signs of a persistent backdoor, bring in a WordPress security specialist or incident response service.
A professional cleanup is often the fastest path when the compromise is deep or business-critical.
For high-traffic stores, membership sites, or sites handling customer data, document each recovery step carefully.
That record can help with hosting support, security audits, and compliance obligations.