wp_salt( string $scheme = 'auth' ): string

Description

define('AUTH_KEY', ' Xakm<o xQy rw4EMsLKM-?!T+,PFF})H4lzcW57AF0U@N@< >M%G4Yt>fz]MON');
define('SECURE_AUTH_KEY', 'LzJ}op]mr|6+![P}Ak:uNdJCJZd>(Hx.-Mh#Tz)pCIU#uGEnfFz|f ;;eU%/U^O~');
define('LOGGED_IN_KEY', '|i|Ux9<p-h$aFf(qnT:sDO:D1P^wZ$$/Ra@miTJi9G;ddp_<q}6H1)o|a +&JCM');
define('NONCE_KEY', '%:R{[P|,s.KuMltH5}cI;/k<Gx~j!f0I)m_sIyu+&NJZ)-iO>z7X>QYR0Z_XnZ@|');
define('AUTH_SALT', 'eZyT)-Naw]F8CwA*VaW#q*|.)g@o}||wf~@C-YSt}(dh_r6EbI#A,y|nU2{B#JBW');
define('SECURE_AUTH_SALT', '!=oLUTXh,QW=H }L|9/^4-3 STz},T(w}W<I.JjPi)<Bmf1v,HpGe}T1:Xt7n');
define('LOGGED_IN_SALT', '+XSqHc;@Q*K_b|Z?NC[3H!!EONbh.n<+=uKR:>*c(ug~EJBf#8u#R{mUEZrozmm');
define('NONCE_SALT', 'hGXHhD>SLWVfg1(1(N{;.V!MoE(SfbA_ksP@&+AycHcAV$+?@3q+rxV{%^VyKT');

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$schemestringoptional

Authentication scheme (auth, secure_auth, logged_in, nonce).Default: 'auth'

Return value

string

Salt value

Performance profile

How much work a call to wp_salt() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reads stored settings via get_site_option(), cached per request but not free on a cold cache.

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

12–97

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 213.

Plugin surface

1 hook

Third-party callbacks on 'salt' run inside this call, and their cost is not bounded by anything here.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksapply_filters()called directly
• optionnetwork optionget_site_option()called directly

Further down the call graph this can also reach cache, serialize, transient and query. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 16 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_salt() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 2

2 hooks fire while wp_salt() runs, in this order:

1. 1
   apply_filters( salt )filterline 2597 (+12 into the body)

   Filters the WordPress salt.

2. 2
   apply_filters( salt )filterline 2697 (+112 into the body)

   Filters the WordPress salt.

Uses · 6

• apply_filters()Calls the callback functions that have been added to a filter hook.
• __()Retrieves the translation of $text.
• wp_prime_site_option_caches()Primes specific network options for the current network into the cache with a single database query.
• get_site_option()Retrieve an option value for the current network based on name of option.
• wp_generate_password()Generates a random password drawn from the defined set of characters.
• update_site_option()Updates the value of an option that was already added for the current network.

Used by · 1

• wp_hash()Gets the hash of the given string.

Source code

View on Trac ↗View on GitHub ↗

2585	function wp_salt( $scheme = 'auth' ) {2586		static $cached_salts = array();2587		if ( isset( $cached_salts[ $scheme ] ) ) {2588			/**2589			 * Filters the WordPress salt.2590			 *2591			 * @since 2.5.02592			 *2593			 * @param string $cached_salt Cached salt for the given scheme.2594			 * @param string $scheme      Authentication scheme. Values include 'auth',2595			 *                            'secure_auth', 'logged_in', and 'nonce'.2596			 */2597			return apply_filters( 'salt', $cached_salts[ $scheme ], $scheme );2598		}2599 2600		static $duplicated_keys;2601		if ( null === $duplicated_keys ) {2602			$duplicated_keys = array();2603 2604			foreach ( array( 'AUTH', 'SECURE_AUTH', 'LOGGED_IN', 'NONCE', 'SECRET' ) as $first ) {2605				foreach ( array( 'KEY', 'SALT' ) as $second ) {2606					if ( ! defined( "{$first}_{$second}" ) ) {2607						continue;2608					}2609					$value                     = constant( "{$first}_{$second}" );2610					$duplicated_keys[ $value ] = isset( $duplicated_keys[ $value ] );2611				}2612			}2613 2614			$duplicated_keys['put your unique phrase here'] = true;2615 2616			/*2617			 * translators: This string should only be translated if wp-config-sample.php is localized.2618			 * You can check the localized release package or2619			 * https://i18n.svn.wordpress.org/<locale code>/branches/<wp version>/dist/wp-config-sample.php2620			 */2621			$duplicated_keys[ __( 'put your unique phrase here' ) ] = true;2622		}2623 2624		/*2625		 * Determine which options to prime.2626		 *2627		 * If the salt keys are undefined, use a duplicate value or the2628		 * default `put your unique phrase here` value the salt will be2629		 * generated via `wp_generate_password()` and stored as a site2630		 * option. These options will be primed to avoid repeated2631		 * database requests for undefined salts.2632		 */2633		$options_to_prime = array();2634		foreach ( array( 'auth', 'secure_auth', 'logged_in', 'nonce' ) as $key ) {2635			foreach ( array( 'key', 'salt' ) as $second ) {2636				$const = strtoupper( "{$key}_{$second}" );2637				if ( ! defined( $const ) || true === $duplicated_keys[ constant( $const ) ] ) {2638					$options_to_prime[] = "{$key}_{$second}";2639				}2640			}2641		}2642 2643		if ( ! empty( $options_to_prime ) ) {2644			/*2645			 * Also prime `secret_key` used for undefined salting schemes.2646			 *2647			 * If the scheme is unknown, the default value for `secret_key` will be2648			 * used too for the salt. This should rarely happen, so the option is only2649			 * primed if other salts are undefined.2650			 *2651			 * At this point of execution it is known that a database call will be made2652			 * to prime salts, so the `secret_key` option can be primed regardless of the2653			 * constants status.2654			 */2655			$options_to_prime[] = 'secret_key';2656			wp_prime_site_option_caches( $options_to_prime );2657		}2658 2659		$values = array(2660			'key'  => '',2661			'salt' => '',2662		);2663		if ( defined( 'SECRET_KEY' ) && SECRET_KEY && empty( $duplicated_keys[ SECRET_KEY ] ) ) {2664			$values['key'] = SECRET_KEY;

Changelog

Introduced in 2.5.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/pluggable.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.