Assist Security

php ( AUTH_KEY through NONCE_SALT ). If those secrets leak — through an old backup, a stolen config file, or a contractor who still has access — an attacker can forge valid authentication cookies for as long as the keys stay unchanged. Rotating them invalidates every existing session immediately.

Assist Security makes that rotation safe, automatic, and auditable.

🔑 Rotate Security Keys

• One-click rotation from a clean, colorful settings screen

• Locally generated keys using PHP’s cryptographically secure random number generator. No calls to any external API, no network dependency

• Verified atomic writes. The new configuration is built in memory, written to a temporary file with restricted permissions, verified, atomically swapped in, then verified again — with automatic rollback if any step fails. The writer refuses to touch your file unless all eight keys are found, so a partial rotation is impossible

• Key health checks for missing, weak, duplicated, or placeholder keys. Only the verdict is ever shown; your key values never leave the server

• Audit log recording every attempt: timestamp, result, trigger, user, optional IP, duration, and how many sessions were signed out — with filtering, pagination, and CSV export

• Failure alerts emailed to the site administrator if a rotation ever fails

• Site Health test that flags key problems and keys older than 180 days

• WP-CLI commands — wp assist-security rotate and wp assist-security status

• Custom config locations supported: wp-salt.php, a wp-config.php above the web root, or any path you choose with a filter

Built the right way

• Beautiful, responsive settings screen with no page reloads and no build step

• REST API under assist-security/v1; no admin-ajax

• No bundled SDKs, no Composer dependencies, no external HTTP requests, no telemetry

• Every input sanitized, every output escaped, every query prepared

• Multisite aware: management is restricted to network administrators

• Privacy-conscious: IP logging is optional and data removal on uninstall is opt-in

• Settings import and export as JSON

• Fully translatable, with a bundled POT file

Assist Security is built on a module architecture, so further protections can be added as self-contained modules in future releases.