Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Your config file shouldn't be public at all. It includes your database credentials in addition to the 8 SALTs WordPress. (The secret keys alone make it possible to brute force your log-in in a bout a week: http://codeseekah.com/2012/04/09/why-wordpress-authentication-unique-keys-and-salts-are-important/)

share|improve this answer
2  
It also prevents portability, the test instance may not have the same DB details etc –  Tom J Nowell Aug 16 '13 at 9:48
    
Great, thanks for the him, Stephen! I'll replace the salts like the database credentials during deploy with Capistrano. –  Till Aug 17 '13 at 23:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.