[wp-hackers] The security week? :)

[Austin Matzko]

On Thu, Apr 17, 2008 at 9:48 AM, MichaelH <justmichaelh at gmail.com> wrote:
>  2. If you don't change the 'put your unique phrase here'  phrase, you are
>  actually better off deleting the SECRET_KEY definition from wp-config.php.

No, that is not the case.  Having the default SECRET_KEY and having no
secret key end up with the same result, and it would be better to
leave it in there as a reminder to customize it later.

> 4. And again, for upgrading users, if they don't add the SECRET_KEY
> definition to their existing wp-config.php, that is okay.

"Okay," but not good.  All WP users should have a custom SECRET_KEY to
reduce the risk of a security compromise.

> 5.  At any time, you can change the SECRET_KEY value in wp-config.php and
> NOT cause problems when users log in with their existing password.

No problems, but changing the SECRET_KEY will invalidate everyone's
cookies, forcing them to log in again.