0

Few hours back I was trying to login into my wordpress website, but it gave the error - Incorrect Password.

So, I ran a scan on my wordpress website with the command - "wp core verify-checksums"

It gave the Warning that wp-salt.php and wp-cli.yml file should not exist in public_html folder.

I checked the wp-salt.php file, it contains the content :-

<?php
/**#@+
 * Authentication Unique Keys and Salts.
 *
 * Change these to different unique phrases!
 * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
 * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
 *
 */
define('AUTH_KEY',         'some value');
define('SECURE_AUTH_KEY',  'some value');
define('LOGGED_IN_KEY',    'some value');
define('NONCE_KEY',        'some value');
define('AUTH_SALT',        'some value');
define('SECURE_AUTH_SALT', 'some value');
define('LOGGED_IN_SALT',   'some value');
define('NONCE_SALT',       'some value');

When I deleted the files then the website became inaccessible. I want to know if these files are safe? Is my website hacked?

1 Answer 1

1

These are safe.

Normally the contents of wp-salt.php is in the wp-config.php. The reason you site became inaccessible is due to the change in wp-config.php to include wp-salt.php. I.e. include('wp-salt.php');

You can delete wp-salt.php, but be sure to copy the defines into the wp-config.php were the "include('wp-salt.php');" line is and remove the "include('wp-salt.php');" line.

The wp-cli.yml file is part of WP-Cli. I suspect is was created when you ran "wp core verify-checksums". To be sure, you should read the contents.

1
  • The salt isn't safe if someone can download it though, e.g. if public_html isn't set to run PHP files, because then they can forge cookies for the site. I agree these should be moved into config yes.
    – Rup
    May 23 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.