WordPress security key & salt rotation

What it does

WordPress signs every login cookie with the eight secret keys and salts in wp-config.php. Rotating them instantly invalidates every existing session and remember-me cookie: the single fastest way to throw intruders out after a suspected compromise, and good hygiene on a schedule.

How it works

One click fetches fresh keys from the official WordPress.org generator and rewrites wp-config.php. Before every change the old keys are backed up for 24 hours and can be restored. Rotations are rate-limited to one per five minutes, except emergency rotations, which skip the limit because during an incident, speed wins.

Scheduling runs on WordPress cron: daily, weekly on a chosen day, or monthly on a chosen date, at the time you set. Quiet hours shift a scheduled run outside business hours, a skip switch passes over the next run, and pre-change notifications warn you before a rotation logs everyone out.

• On-demand rotation with change notes
• Emergency mode for incident response
• 24-hour key backup with restore
• Daily / weekly / monthly schedules with quiet hours
• Skip-next-run and pause switches
• Pre-change email notification option

One honest caveat

Rotation logs everyone out. That is the point. Schedule it for your quietest hour, or use the pre-change notification so your team is not surprised.