Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The supported automatic method is WP-CLI’s wp config shuffle-salts command. Run it from your WordPress installation to replace the authentication keys and salts in wp-config.php. WordPress will invalidate existing login cookies, so every user must sign in again after the rotation.
What changing WordPress salts does
WordPress stores authentication keys and salts in wp-config.php. They help protect authentication cookies and related security tokens. Changing them invalidates existing cookies; WordPress documents that this “will force all users to have to log in again.” See the WordPress wp-config.php handbook.
Plan the change for a maintenance window if a site has many editors, members or customers. Users who are logged in will be signed out, but the rotation does not delete their accounts or change their passwords.
Automatically rotate salts with WP-CLI
1. Open the WordPress installation
Use a shell session on the server, container or deployment environment that contains the WordPress files. Your account needs permission to run WP-CLI and to modify the relevant configuration file.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Run the shuffle command
wp config shuffle-saltsThe command refreshes the salts defined in wp-config.php. WP-CLI runs this command on the before_wp_load hook, before WordPress loads. The documented command is described in the WP-CLI config shuffle-salts reference.
3. Use a non-default configuration path when necessary
If the configuration file is not in the default location, specify it explicitly:
wp config shuffle-salts --config-file=/path/to/wp-config.phpReplace the example path with the actual file path. Keep the command and path inside your deployment or administration system rather than exposing the contents of the configuration file.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Confirm the operational result
- Check that WP-CLI reports a successful update.
- Open the site and authenticate with a test account.
- Verify that expected administrators and editors can sign in again.
- Watch application and web-server logs for configuration or permission errors.
Which keys does the command change?
With no key names supplied, WP-CLI uses WordPress core’s standard set:
| Authentication keys | Salt constants |
|---|---|
AUTH_KEY |
AUTH_SALT |
SECURE_AUTH_KEY |
SECURE_AUTH_SALT |
LOGGED_IN_KEY |
LOGGED_IN_SALT |
NONCE_KEY |
NONCE_SALT |
These are the eight defaults identified in the WP-CLI documentation and shown in the WordPress sample configuration. WP-CLI also accepts one or more key arguments when an administrator needs to target specific entries; omitting key arguments selects the core defaults.
Manual editing versus WP-CLI
| Approach | Best fit | Repeatability | Important consequence |
|---|---|---|---|
Directly edit wp-config.php |
A one-time change when you have file access | Lower; each update depends on careful manual editing | Changing the values invalidates existing cookies and signs users out |
wp config shuffle-salts |
Scripts, deployments and repeatable administration | Higher; the same documented command can be run consistently | Changing the values invalidates existing cookies and signs users out |
If you edit the file directly, replace the eight configured values with strong, unique random values. WordPress points administrators to its secret-key service for generating unique phrases; do not copy the sample values into a production site. The wp_salt() reference explains the requirement for strong, random secrets.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Automating the command on a schedule
A cron job, deployment pipeline or maintenance workflow can serve as the wrapper that invokes wp config shuffle-salts. Choose the cadence according to your organization’s incident-response and change-management policy. The official WordPress and WP-CLI references do not prescribe a universal rotation interval, so do not treat a daily, monthly or yearly schedule as a WordPress requirement.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Operational safeguards
- Notify users before a planned rotation because active sessions will end.
- Run the command with the intended site and configuration path explicitly selected.
- Restrict access to the job and its logs;
wp-config.phpcontains secrets. - Keep a tested recovery copy of the configuration according to your normal backup policy.
- Test the site after deployment, especially if authentication is handled through a reverse proxy, object cache or single-sign-on integration.
Common problems and fixes
“wp: command not found”
WP-CLI is not available in the shell environment. Install or expose WP-CLI through the server or deployment image, then rerun the command from the WordPress installation.
The wrong site was changed
Confirm the current working directory and use --config-file=/path/to/wp-config.php to identify the intended configuration explicitly.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The command cannot write the file
Check filesystem ownership and permissions for wp-config.php. Run the command as the deployment or service account that is authorized to update the file, rather than weakening permissions broadly.
Users cannot stay logged in afterward
That is the expected result of a salt rotation for existing cookies. Have users authenticate again. If new logins also fail, inspect the resulting configuration, PHP or web-server logs, and any authentication middleware for a separate issue.
Recommended Free Tools
Quick Recap
What to remember
- Use
wp config shuffle-saltsfor a repeatable automatic rotation. - Add
--config-file=<path>when the configuration is outside the default path. - Without key arguments, WP-CLI targets WordPress’s eight standard key and salt constants.
- Every rotation invalidates existing cookies and requires users to log in again.
- Use unique, strong random values and protect
wp-config.php. - No official source sets a universal rotation schedule; define one as an operational policy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
