WordPress Salt Rotation SOP

WordPress Salt Rotation SOP
Rotating auth keys invalidates every active session and forces re-login. Run after any suspected compromise.

— Step 1: Pull fresh keys from api.wordpress.org/secret-key/1.1/salt/.
— Step 2: Replace all 8 constants in wp-config.php (AUTH_KEY through NONCE_SALT). Replace, don't append.
— Step 3: Verify the file still has no trailing whitespace after ?> — none should exist.
— Step 4: Confirm every admin gets logged out. If a session survives, a second config is being loaded.
— Step 5: Reset all admin passwords in the same window.
— Step 6: Log the rotation date in your incident sheet.

Run this every time you offboard an admin or pull a leaked backup.
Run this every time.