Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have come across the following code in a new clients existing website in wp-config.php

define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

I searched online and found a post that suggests if the keys and salts are duplicated in the config then WordPress will generate new salts and keep them within the database. This appears to be true as there are records within wp_options table with the salt names and values.

Primary question: Is 'WordPress keeping salts within the database' a security risk?

Care to explain: Is there a reason why they are primarily in the config file and should I replace the config file values with the database ones and remove the database values?

share|improve this question

migrated from webmasters.stackexchange.com Jul 7 at 15:12

This question came from our site for pro webmasters.

1 Answer 1

up vote 2 down vote accepted

From the WordPress Codex:

The secret key is located in two places: the database in case the secret key isn't defined in the second place, which is in the wp-config.php file. If you are going to set the secret key, then you must do so in the wp-config.php file.

The secret key in the database is randomly generated and will be appended to the secret key that is in wp-config.php file in some instances. It is important to have the secret key defined or changed in wp-config.php.

If you have installed WordPress 2.5 or later, then you will have the SECRET_KEY defined in the wp-config.php already. You will want to change the value in it because hackers will know what it is. If you have upgraded to WordPress 2.5 or later version from a version before WordPress 2.5, then you should add the constant to your wp-config.php file.

Salting passwords helps against tools which has stored hashed values of common dictionary strings. The added values makes it harder to crack if given salt string is not weak.

You should set the salts inside the wp-config.php as keeping the salts solely in the database is a security risk. It is more likely that someone nefarious would be able to grab the entire salt if it is stored solely in the database, whereas if you store the salt in the wp-config.php and supplement it with the salt within the database, it will be much harder to grab the entire salt. You can randomly generate these salts with the online generator. Once they occur in the wp-config.php file, the database salts will no longer be valid by themselves and will no longer present a security risk.

share|improve this answer
    
"because it is more likely to be revealed in the database than in the wp-config.php file" Based on? –  Rarst Jul 7 at 16:35
    
@Rarst, bad phrasing, will update. What I mean is, it is more likely that someone would be able to grab the entire salt if it is stored solely in the database, whereas if you store the salt in the wp-config.php and supplement it with the salt within the database, it will be much harder to grab the entire salt. –  michaelrmcneill Jul 7 at 16:53
    
So does this mean even if the config salts are set uniquely, there will also be database salts set anyway? This is all very confusing IMO. Probably for the best. –  Studio NEC Jul 7 at 21:30
    
From what I understand, the salts from the database are added to the salts from the wp-config.php file. –  michaelrmcneill Jul 7 at 21:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.