I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.


Your config file shouldn't be public at all. It includes your database credentials in addition to the 8 SALTs WordPress. (The secret keys alone make it possible to brute force your log-in in a bout a week: http://codeseekah.com/2012/04/09/why-wordpress-authentication-unique-keys-and-salts-are-important/)

| improve this answer | |
  • 2
    It also prevents portability, the test instance may not have the same DB details etc – Tom J Nowell Aug 16 '13 at 9:48
  • Great, thanks for the him, Stephen! I'll replace the salts like the database credentials during deploy with Capistrano. – Till Aug 17 '13 at 23:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.