How To Set up secret keys in WordPress 2.6+

I have been a security freak for all of my websites. A few of my websites have been hacked in the past, and I hate the period. I have written in the past a post about how to protect your blog from hackers. Today I will talk about another key thing that WordPress have which makes it a lot more secure than people think.

A client recently told me that WordPress is an open source software hence not secure. Obviously understandable from someone who does not know anything about wordpress. Yes a lot of open source softwares have some security issues, but wordpress is getting stronger and stronger after each release.

In the release of wordpress 2.6 and onward they have included this feature of secret keys. Which adds an extra layer of security to your blog and make it more secure. In order to do this you would have to open your: wp-config.php file, and right after the other define tags add the following:

define(‘AUTH_KEY’, ‘put your unique phrase here’);
define(‘SECURE_AUTH_KEY’, ‘put your unique phrase here’);
define(‘LOGGED_IN_KEY’, ‘put your unique phrase here’);
define(‘NONCE_KEY’, ‘put your unique phrase here’);

You’ll find these lines in the wp-config-sample.php file as well.

These three unique phrases should be random. Anything 60+ characters and relatively random will work. They should each be different. In other words, you need three phrases, not one.

Note that doing this will invalidate all your login cookies, so everybody on your site will have to re-login, but doing it will greatly increase the cookie strength of WordPress 2.6. This means that your login cookies, if intercepted, won’t be able to be reproduced as easily. It also means that somebody who gains read-only access to your database through some other means won’t be able to login to your site.

** DO NOT SHARE YOUR SECRET KEYS BECAUSE THEN THEY WON’T BE SECRET **