I'm auto-generating WordPress (5.9.3) sites on a VPS. I could, as part of the generation script, create random strings for the various keys and salts in wp-config.php. However, there doesn't appear to be any unequivocal statement in the docs that this is actually necessary, and various sources appear to state that WP will generate the keys and salts anyway if there are none in wp-config.php.
- If I choose to leave this up to WP, what should I actually put in wp-config.php? I don't want to leave in the default 'put your unique phrase here', because the end-user is then guaranteed to complain that the site is "insecure" and I don't know what I'm doing. Can I just delete the key/salt lines?
- Some sources (this SO answer, for example) appear to state that putting the keys and salts in wp-config.php is "more secure" than using the database version. Does this make any sense? In my case, the database (MariaDB 10.3.34) has no non-localhost access, and the DB passwords appear to be stored as two rounds of SHA1 hashing, which is fairly secure. Realistically speaking, it's much more likely that someone will break into the server itself, via Apache or otherwise, and simply read the plaintext DB password out of... wait for it... wp-config.php. And, if they can do that, cookie security is irrelevant anyway.