Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm working on a site for someone that doesn't have any keys in the wp-config file. Isn't this a serious issue? I know I can generate these but I wonder if this will have any side-effects..also, is this currently a security risk because the site had been hacked.

Example:

define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');
share|improve this question
4  
Those are keys. They're just not good ones. Grab some ASAP from api.wordpress.org/secret-key/1.1/salt . –  Pat J Nov 7 '13 at 14:51
add comment

2 Answers 2

It is indeed a security issue to have those left as the defaults, but it is not an extremely serious issue.

To mitigate the problem of known default salts, WordPress intentionally recognizes when those values are left as "put your unique phrase here" and will not use that phrase as a key/salt. Instead, it generates random 64 character salts internally and stores them in the database for usage as salting values. WordPress also ignores any duplicated values across those salts, and generates randoms in those cases too, so any default value used that is identical across them will be rejected as it may potentially known to an attacker.

Now, this is still not ideal, because the salts are then stored in the database. If an attacker happens to get read access to your database, or gets a dump of the database, then they could brute force the hashes and gain further access. But the default values are not used for actual salting.

Ideally, the salts should be defined in the config file, because an attacker would then need to obtain the contents of that file, so reading the database wouldn't get them anything useful.

Note that you can change these values at any time with no serious consequences other than having to log in again, as all the cookies and such will change.

share|improve this answer
add comment

Yes, predictable (or known) keys present a serious security vulnerability.

These keys (salts) are used, for instance, to create a secure cookie for log-in. I explain in more detail in this post, but the upshot is that if the salts are known, then its relatively easy to brute-force the log-in cookie and so get access to the admin.

A conservative estimate on such a brute-force attack is about a week.

source: http://codeseekah.com/2012/04/09/why-wordpress-authentication-unique-keys-and-salts-are-important/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.