I guess I am exposing some lack of security knowledge here, but shouldn't it be enough to have one salt? Why are four different salts necessary?

define('AUTH_SALT',        'z(ly|p-aeKf^I~OfOUUIL&Y?C5Z.iu|L}kY%dvclq.h9n`)MlZe6');
define('SECURE_AUTH_SALT', 'NIY8g>=l9y~eV~WLu 3n>UG#3wSl4YfT%;z9`7m9Gk/k_Vn4`ej8');
define('LOGGED_IN_SALT',   '<-[R@, I;m%n*9G?CU1a:))pEAa/r5X5@pT`cO2H|c2&x~G<p*3T:-5v<N');
define('NONCE_SALT',       'm(-0:+r0a%z~a:2F;]-geM$9~!4j(q3QdpkmB7;P+ZYYw7Rdy{97fS');

(Don't worry, values mangled and it is a local site.)

1 Answer 1


I posted the question on the wordpress slack and the answer I got https://wordpress.slack.com/archives/core/p1447905339001506 is that the difference is semantic and not practical and there is no reason to prefer the usage of one over the others (except for semantics of course)

  • Please post the full answer here; I don't want to sign up to slack. Commented Sep 14, 2016 at 7:29
  • @TheBlackBenzKid, that is the answer Commented Sep 14, 2016 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.