I’ve gotten into the habit of actually reading the various blogs to which there are links on my WordPress dashboard and I saw this today from boren.nu:
To make cookies secure against attacks where someone has managed to get into your database through an SQL injection exploit or other means, WordPress 2.5 introduced a user-definable constant called SECRET_KEY. If you look at the sample wp-config.php shipped with 2.5, you’ll see these lines.
// Change SECRET_KEY to a unique phrase. You won’t have to remember it later,
// so make it long and complicated. You can visit https://www.grc.com/passwords
.htm
// to get a phrase generated for you, or just make something up.
define(’SECRET_KEY’, ‘put your unique phrase here’); // Change this to a unique phraseIf you upgraded from a previous version of WordPress you probably won’t have these lines in your wp-config.php.
That last bit is, of course, the critical thing for me and had me going back and inserting SECRET_KEYs into all my older/upgraded WordPress installs. Just remember that if you’re integrating with bbPress, you have to match the SECRET_KEYs in wp-config.php and bb-config.php.
Comments 1
I have the same problem in upgrading my older blog – so I wrote a plugin to make it easier. It only handles WP, so you’d need to copy the result over to bbPress. But for most people, it saves a bit of editing:
http://ActiveBlogging.com/info/how-to-change-wordpress-secret_key-plugin/
Posted 29 Apr 2008 at 5:33 am ¶Trackbacks & Pingbacks 1
[...] notice also mentioned the SECRET_KEY thing that I talked about yesterday and gave a link to auto-generate the line for wp-config.php: Since 2.5 your wp-config.php file [...]