Security keys in WordPress are used to store a lot of critical information. For instance, they are used to manage logged-in sessions securely. Most of the time, you can forget they exist, and they continue to do their job well. 

After a hack, however, the scenario is different. Changing the security keys becomes critical to prevent reinfection. 

This is because, if a WordPress site is hacked, you should assume that the hacker had access to the security keys in your wp-config file. Using the keys, they can regain access to your site even after cleaning the malware. And then you are back to square one.

Reduce reinfection with a post-hack checklist

When you clean your site using MalCare, you can rest assured there won’t be a trace of malware left. Our automated cleaner targets every bit of malicious code—malware and backdoors—during the cleanup process. 

However, there is still the post-hack checklist to get through: checking for fraudulent user accounts, resubmitting a sitemap, and getting off Google’s blacklist, to name a few. Changing your security keys is high on that list, as it is an important step to prevent reinfection.

Automatically change security keys after a cleanup

Instantly invalidate any unauthorized access to your site, shutting the doors on attackers.

By changing the security keys, you force log out every logged-in user, and render the active session cookies invalid. Hackers lose access to your site in one move.

Your legitimate users will also get logged out, and have to log in again, but this is a minor inconvenience. In fact, as a next step, you should reset their passwords as well.

Prevent a wide range of attacks

Resetting WordPress security keys particularly fortifies your site against several types of attacks: