Made on your device, never sent
Free tool
New security keys and salts for your wp-config.php in one click. Replacing them signs everyone out of WordPress, which is exactly what you want after a hack or a leaked password.
Replace the matching lines in wp-config.php with these.
Use WP-CLI? wp config shuffle-salts does the same on the server.
How to use them
Five minutes, and every stolen login cookie stops working.
Download a copy first, through your hosting file manager or FTP, so you can put it back if anything goes wrong.
They start define( 'AUTH_KEY' and end with 'NONCE_SALT', usually about halfway down the file.
Replace all eight with the lines above and save. Keep the quotes exactly as they are.
Everyone is signed out, you included, and any stolen session is useless. Then change the admin passwords.
Questions
Eight random values in wp-config.php that WordPress uses to sign the cookies that keep you signed in. Anyone who knows them could forge a login cookie, so they should be long, random and secret.
After a hack or malware cleanup, when someone with access leaves, if wp-config.php may have been seen, or if your site still has the placeholder "put your unique phrase here". Changing them now and then does no harm.
No. Your content, settings and passwords are untouched. Everyone is simply signed out and has to sign in again, and anything still in a shopping basket for a signed-in customer may need adding again.
With this one, yes: they're made by your own browser and never sent to us or anyone else. There's no tracking or advertising code on this page.
It's one step. Attackers usually leave backdoors in files and the database that new salts won't remove. Our malware removal cleans the whole site by hand within 24 hours.
Free tools
Encrypted in your browser
Send a password or note as a link that works once, then deletes itself. Encrypted in your browser, so not even we can read it.
Create a secure linkMade on your device
Strong random passwords, made in your browser and never sent anywhere. No adverts, no sign up.
Make a passwordChecked without being sent
See if a password has turned up in a known data breach, without the password ever leaving your device.
Check a password30+ checks, in plain English
Check a domain's nameservers, website, MX, SPF, DMARC and more, in plain English with how to fix each problem.
Run a DNS reportBy our sister site, SitePulse
A free check of your WordPress site from the outside, by SitePulse: the versions it gives away, files that shouldn't be public and common weak spots.
Scan with SitePulse