wp-salts

wp-salts regenerates the eight WordPress salts in an .env file. Use it when setting up a fresh install (the example env ships with generateme placeholders), when rotating after a leak, or on a schedule from cron.

bash scripts/wp-salts.sh

Salt	Effect of rotating
AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY	Logs every user out
AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, NONCE_SALT	Logs every user out

The script asks for confirmation before writing and always backs up the file to <file>.bak first.

Note

WP2FA_ENCRYPT_KEY is deliberately out of scope. WP 2FA encrypts every stored 2FA secret with it, so replacing it locks enrolled users out of their second factor — they would all have to re-enrol. Set it once by hand with openssl rand -base64 32 and leave it alone.

---

Options

bash scripts/wp-salts.sh [options] [SALT...]

Option	Description
SALT...	Only regenerate the named salts, e.g. bash scripts/wp-salts.sh NONCE_SALT
-f, --file <path>	Env file to update (default: .env)
-p, --print	Print fresh salts to stdout, write nothing
-y, --yes	Skip the confirmation prompt — required for unattended runs
-h, --help	Show help

---

Scheduled rotation

Rotating salts on a schedule is the main use. Every run invalidates all sessions, so pick an hour when a forced logout is harmless:

# Rotate WordPress salts every Sunday at 04:00
0 4 * * 0 /bin/bash /home/runcloud/webapps/your-app/scripts/wp-salts.sh --yes >> /var/log/wp-salts.log 2>&1

Details that matter for cron:

• --yes is required. Without a terminal the script refuses rather than blocking on the prompt, so a misconfigured job fails loudly instead of hanging.
• Paths resolve against the project root, not the working directory — cron’s bare environment is fine, and --file accepts a relative path or an absolute one.
• Output is timestamped when stdout is not a terminal, so log lines stay readable.
• Permissions are preserved. The file is rewritten through a temp file in the same directory and moved into place, keeping the original mode (falling back to 600).
• Run it as the user that owns .env, otherwise the rewrite fails on the permission check.

---

How values are written

Each salt is replaced in place, so surrounding comments and ordering stay intact. A commented-out key is uncommented, and a key that is missing entirely lands on the # !KEYS HERE! # marker if there is one, otherwise at the end of the file.

AUTH_KEY='generateme'
AUTH_KEY='(>_Y87NFIMa!4YR&pcwmqc?*BLZQqaC{Au?t(W.&Mvi$3hGo1F5o8F~I7Di0^p2<'

Salts are 64 random characters drawn from /dev/urandom, excluding quotes and backslashes. Values are single quoted, so they are read literally with no variable interpolation.

---

First deploy

.env files are never committed, so production salts are generated on the server after deploying .env.prod.example — the # !KEYS HERE! # placeholder means production ships with no salts at all until you run:

bash scripts/wp-salts.sh --yes