I guess I am exposing some lack of security knowledge here, but shouldn't it be enough to have one salt? Why are four different salts necessary?

define('AUTH_SALT',        'z(ly|p-aeKf^I~OfOUUIL&Y?C5Z.iu|L}kY%dvclq.h9n`)MlZe6');
define('SECURE_AUTH_SALT', 'NIY8g>=l9y~eV~WLu 3n>UG#3wSl4YfT%;z9`7m9Gk/k_Vn4`ej8');
define('LOGGED_IN_SALT',   '<-[R@, I;m%n*9G?CU1a:))pEAa/r5X5@pT`cO2H|c2&x~G<p*3T:-5v<N');
define('NONCE_SALT',       'm(-0:+r0a%z~a:2F;]-geM$9~!4j(q3QdpkmB7;P+ZYYw7Rdy{97fS');

(Don't worry, values mangled and it is a local site.)


I posted the question on the wordpress slack and the answer I got https://wordpress.slack.com/archives/core/p1447905339001506 is that the difference is semantic and not practical and there is no reason to prefer the usage of one over the others (except for semantics of course)

  • Please post the full answer here; I don't want to sign up to slack. – TheBlackBenzKid Sep 14 '16 at 7:29
  • @TheBlackBenzKid, that is the answer – Mark Kaplun Sep 14 '16 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.