Cosa, perché e come delle chiavi di sicurezza di WordPress

27 commentiLascia una risposta

1. Mrteesurez

   I am just hearing ‘SALT’ here in this post, what’s the difference between SALT and KEY ?
   Can I just update those keys even if I didn’t suspect any hack attempt ?
   If yes, when often should it be changed ?? Thanks.

   Rispondi

   • WPBeginner Support

     It depends on your personal preference but they can be as changed as often as weekly or once a quarter depending on how much you would like to focus on changing them.

     Rispondi

     Admin

2. Jiří Vaněk

   Regarding security keys, I encountered an issue when migrating the website to a new database. Even after changing the connection in the wp-config.php file, WordPress refused to connect to the new DB, reporting an ‘establishing error.’ Eventually, I had to delete the old wp-config.php, upload a new one from the installation package, re-enter the connection to the new database, and then everything worked fine. It seems that the keys in the wp-config.php file were the culprit.

   Rispondi

3. Josh

   How often do you recommend changing the keys? Quarterly as shown in the screenshot?

   Rispondi

   • WPBeginner Support

     We do not have a specific recommended refresh time at the moment other than after a hack on your site at a minimum.

     Rispondi

     Admin

4. Bjornen Nilsson

   Hi,

   QUESTION »
   Will it affect anything besides “extreme” increased security if one has the web browser set to delete all history, temp, cookies etc. every time it is shut down AND if one changes the SALT in wp-config after logging out each time?

   Thanks!

   Rispondi

5. shanderman

   Hi,
   I have 2 url product,for 1 product.like this:

   example.com/?product=product-name
   example.com/product/product-name/

   why? how should i fix it? please help me.

   Rispondi

   • WPBeginner Support

     Hi shanderman,

     Please visit Settings » Permalinks page to make sure that your WordPress site is using SEO friendly URLs.

     After that view your website’s source code and make sure that it is showing the URL format that you like.

     The ugly URL structure will still work in WordPress if you typed it in the browser. However, your product’s canonical URL will be the one you choose on the permalinks settings page. This is the URLs that search engines will follow and index.

     Rispondi

     Admin

6. sam

   I am a beginner to Wordpress , i have a doubt how those keys make the Wordpress secure ? i want to know the actual role and working of the keys ?

   Rispondi

7. Kishan Dalsania

   What is the actual benefit of these using the keys in config.php. Can you define how it will work to prevent the hackers?

   Rispondi

8. sam

   Hi , i have used this method and can not log onto my site at all. how do i fix it or remove the issues

   Rispondi

   • WPBeginner Support

     Please take a look at our tutorial on what to do when you are locked out of WordPress admin area.

     Rispondi

     Admin

9. kOoLiNuS

   Just a quick question… Why do you suggest to:

   We recommend that you use that rather than inventing your own.

   Instead of the latter? Have you got some links that dig this approach?
   Thank you in advance!

   Rispondi

10. Nick

    In wordpress 3.1 these keys are automatically generated.

    Rispondi

    • MichealKennedy

      Was just gonna ask “why don’t they just automatically generate these for you?” but you answered it

      Rispondi

11. Riese F

    Appreciate this information and quickly updated my files. My concern is the same as Ricks’ from April in that if my wp-config.php file is hacked then these keys are available to whomever is looking at them correct? But then I thought that if my wp file is hacked and someone other than me is looking at them I am already in trouble…

    Any precaution is better than just hoping for the best though! Thank you for your work and efforts.

    Rispondi

12. Keith Davis

    Hi
    Thanks for a short and informative post.
    I notice that in your example there are four secret keys.
    There appear to be more secret keys in Wordpress 3.0 – can these be added to previous versions of Wordpress?

    Rispondi

    • Editorial Staff

      Those keys become available with WordPress 3.0

      Rispondi

      Admin

    • Dave

      You’ll need to use 3.0 to utilise all eight secret keys, rather than the former four. The new WordPress random key generator can be found at https://api.wordpress.org/secret-key/1.1/salt

      Rispondi

13. Rick

    Um, so does this change your admin password or what? I don’t understand what this does? Maybe that’s because I’m not a hacker. But, if this is just stored in your config.php file, wouldn’t it be way easier for a hacker just to hack into your ftp site and nab this security key out of the config file?

    I want my WordPress sites to be more secure, but I just don’t understand what this is preventing?

    Rispondi

14. Jack

    Nicely said. The directions are pretty easy, but I think the security and safety is understated in the documentation. Thanks for spelling it out and making the web a safer place.

    Rispondi

15. gabrielle

    if you develop multiple wordpress sites do you create a security key for each one or use the same one on all of them?

    Rispondi

    • Editorial Staff

      Use a new one

      Rispondi

      Admin

16. Konstantin

    While you’re adt it:
    Why not define the salt constants and save yourself some database queries?!

    It should look like this:
    
define('AUTH_SALT', 'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT', 'put your unique phrase here');
define('NONCE_SALT', 'put your unique phrase here');


    This article from Digging into Wordpress explains the advantages of this practice.

    Rispondi

    • Tony

      Thanks for sharing!

      Rispondi

    • Editorial Staff

      Good idea, didn’t even think of that.

      Rispondi

      Admin

17. maged

    very handy and important thanks for sharing

    Rispondi