Assist Security

WordPress signs every login cookie and nonce with eight secret keys and salts stored in wp-config.php (AUTH_KEY through NONCE_SALT). If those secrets leak — through an old backup, a stolen config file, or a contractor who still has access — an attacker can forge valid authentication cookies for as long as the keys stay unchanged. Rotating them invalidates every existing session immediately.

Assist Security makes that rotation safe, automatic, and auditable.

🔑 Rotate Security Keys

• One-click rotation from a clean, colorful settings screen
• Locally generated keys using PHP’s cryptographically secure random number generator. No calls to any external API, no network dependency
• Verified atomic writes. The new configuration is built in memory, written to a temporary file with restricted permissions, verified, atomically swapped in, then verified again — with automatic rollback if any step fails. The writer refuses to touch your file unless all eight keys are found, so a partial rotation is impossible
• Key health checks for missing, weak, duplicated, or placeholder keys. Only the verdict is ever shown; your key values never leave the server
• Audit log recording every attempt: timestamp, result, trigger, user, optional IP, duration, and how many sessions were signed out — with filtering, pagination, and CSV export
• Failure alerts emailed to the site administrator if a rotation ever fails
• Site Health test that flags key problems and keys older than 180 days
• WP-CLI commands — wp assist-security rotate and wp assist-security status
• Custom config locations supported: wp-salt.php, a wp-config.php above the web root, or any path you choose with a filter

Built the right way

• Beautiful, responsive settings screen with no page reloads and no build step
• REST API under assist-security/v1; no admin-ajax
• No bundled SDKs, no Composer dependencies, no external HTTP requests, no telemetry
• Every input sanitized, every output escaped, every query prepared
• Multisite aware: management is restricted to network administrators
• Privacy-conscious: IP logging is optional and data removal on uninstall is opt-in
• Settings import and export as JSON
• Fully translatable, with a bundled POT file

Assist Security is built on a module architecture, so further protections can be added as self-contained modules in future releases.