WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.

share|improve this question
up vote 1 down vote accepted

Your config file shouldn't be public at all. It includes your database credentials in addition to the 8 SALTs WordPress. (The secret keys alone make it possible to brute force your log-in in a bout a week: http://codeseekah.com/2012/04/09/why-wordpress-authentication-unique-keys-and-salts-are-important/)

share|improve this answer
It also prevents portability, the test instance may not have the same DB details etc – Tom J Nowell Aug 16 '13 at 9:48
Great, thanks for the him, Stephen! I'll replace the salts like the database credentials during deploy with Capistrano. – Till Aug 17 '13 at 23:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.