Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm working on a site for someone that doesn't have any keys in the wp-config file. Isn't this a serious issue? I know I can generate these but I wonder if this will have any side-effects..also, is this currently a security risk because the site had been hacked.


define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');
share|improve this question
Those are keys. They're just not good ones. Grab some ASAP from api.wordpress.org/secret-key/1.1/salt . –  Pat J Nov 7 '13 at 14:51
add comment

1 Answer

Yes, predictable (or known) keys present a serious security vulnerability.

These keys (salts) are used, for instance, to create a secure cookie for log-in. I explain in more detail in this post, but the upshot is that if the salts are known, then its relatively easy to brute-force the log-in cookie and so get access to the admin.

A conservative estimate on such a brute-force attack is about a week.

source: http://codeseekah.com/2012/04/09/why-wordpress-authentication-unique-keys-and-salts-are-important/

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.