wp_salt( string $scheme = 'auth' ): string

Description

define('AUTH_KEY', ' Xakm<o xQy rw4EMsLKM-?!T+,PFF})H4lzcW57AF0U@N@< >M%G4Yt>fz]MON');
define('SECURE_AUTH_KEY', 'LzJ}op]mr|6+![P}Ak:uNdJCJZd>(Hx.-Mh#Tz)pCIU#uGEnfFz|f ;;eU%/U^O~');
define('LOGGED_IN_KEY', '|i|Ux9<p-h$aFf(qnT:sDO:D1P^wZ$$/Ra@miTJi9G;ddp_<q}6H1)o|a +&JCM');
define('NONCE_KEY', '%:R{[P|,s.KuMltH5}cI;/k<Gx~j!f0I)m_sIyu+&NJZ)-iO>z7X>QYR0Z_XnZ@|');
define('AUTH_SALT', 'eZyT)-Naw]F8CwA*VaW#q*|.)g@o}||wf~@C-YSt}(dh_r6EbI#A,y|nU2{B#JBW');
define('SECURE_AUTH_SALT', '!=oLUTXh,QW=H }L|9/^4-3 STz},T(w}W<I.JjPi)<Bmf1v,HpGe}T1:Xt7n');
define('LOGGED_IN_SALT', '+XSqHc;@Q*K_b|Z?NC[3H!!EONbh.n<+=uKR:>*c(ug~EJBf#8u#R{mUEZrozmm');
define('NONCE_SALT', 'hGXHhD>SLWVfg1(1(N{;.V!MoE(SfbA_ksP@&+AycHcAV$+?@3q+rxV{%^VyKT');

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$schemestringoptional

Authentication scheme (auth, secure_auth, logged_in, nonce).Default: 'auth'

Return value

string

Salt value

Performance profile

How much work a call to wp_salt() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reads stored settings via get_site_option(), cached per request but not free on a cold cache.

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

12–97

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 213.

Plugin surface

1 hook

Third-party callbacks on 'salt' run inside this call, and their cost is not bounded by anything here.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksapply_filters()called directly
• optionnetwork optionget_site_option()called directly

Further down the call graph this can also reach cache, serialize, transient and query. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 16 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_salt() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 2

2 hooks fire while wp_salt() runs, in this order:

1. 1
   apply_filters( salt )filterline 2593 (+12 into the body)

   Filters the WordPress salt.

2. 2
   apply_filters( salt )filterline 2693 (+112 into the body)

   Filters the WordPress salt.

Uses · 6

• apply_filters()Calls the callback functions that have been added to a filter hook.
• __()Retrieves the translation of $text.
• wp_prime_site_option_caches()Primes specific network options for the current network into the cache with a single database query.
• get_site_option()Retrieve an option value for the current network based on name of option.
• wp_generate_password()Generates a random password drawn from the defined set of characters.
• update_site_option()Updates the value of an option that was already added for the current network.

Used by · 1

• wp_hash()Gets the hash of the given string.

Source code

View on Trac ↗View on GitHub ↗

2581	function wp_salt( $scheme = 'auth' ) {2582		static $cached_salts = array();2583		if ( isset( $cached_salts[ $scheme ] ) ) {2584			/**2585			 * Filters the WordPress salt.2586			 *2587			 * @since 2.5.02588			 *2589			 * @param string $cached_salt Cached salt for the given scheme.2590			 * @param string $scheme      Authentication scheme. Values include 'auth',2591			 *                            'secure_auth', 'logged_in', and 'nonce'.2592			 */2593			return apply_filters( 'salt', $cached_salts[ $scheme ], $scheme );2594		}2595 2596		static $duplicated_keys;2597		if ( null === $duplicated_keys ) {2598			$duplicated_keys = array();2599 2600			foreach ( array( 'AUTH', 'SECURE_AUTH', 'LOGGED_IN', 'NONCE', 'SECRET' ) as $first ) {2601				foreach ( array( 'KEY', 'SALT' ) as $second ) {2602					if ( ! defined( "{$first}_{$second}" ) ) {2603						continue;2604					}2605					$value                     = constant( "{$first}_{$second}" );2606					$duplicated_keys[ $value ] = isset( $duplicated_keys[ $value ] );2607				}2608			}2609 2610			$duplicated_keys['put your unique phrase here'] = true;2611 2612			/*2613			 * translators: This string should only be translated if wp-config-sample.php is localized.2614			 * You can check the localized release package or2615			 * https://i18n.svn.wordpress.org/<locale code>/branches/<wp version>/dist/wp-config-sample.php2616			 */2617			$duplicated_keys[ __( 'put your unique phrase here' ) ] = true;2618		}2619 2620		/*2621		 * Determine which options to prime.2622		 *2623		 * If the salt keys are undefined, use a duplicate value or the2624		 * default `put your unique phrase here` value the salt will be2625		 * generated via `wp_generate_password()` and stored as a site2626		 * option. These options will be primed to avoid repeated2627		 * database requests for undefined salts.2628		 */2629		$options_to_prime = array();2630		foreach ( array( 'auth', 'secure_auth', 'logged_in', 'nonce' ) as $key ) {2631			foreach ( array( 'key', 'salt' ) as $second ) {2632				$const = strtoupper( "{$key}_{$second}" );2633				if ( ! defined( $const ) || true === $duplicated_keys[ constant( $const ) ] ) {2634					$options_to_prime[] = "{$key}_{$second}";2635				}2636			}2637		}2638 2639		if ( ! empty( $options_to_prime ) ) {2640			/*2641			 * Also prime `secret_key` used for undefined salting schemes.2642			 *2643			 * If the scheme is unknown, the default value for `secret_key` will be2644			 * used too for the salt. This should rarely happen, so the option is only2645			 * primed if other salts are undefined.2646			 *2647			 * At this point of execution it is known that a database call will be made2648			 * to prime salts, so the `secret_key` option can be primed regardless of the2649			 * constants status.2650			 */2651			$options_to_prime[] = 'secret_key';2652			wp_prime_site_option_caches( $options_to_prime );2653		}2654 2655		$values = array(2656			'key'  => '',2657			'salt' => '',2658		);2659		if ( defined( 'SECRET_KEY' ) && SECRET_KEY && empty( $duplicated_keys[ SECRET_KEY ] ) ) {2660			$values['key'] = SECRET_KEY;

Changelog

Introduced in 2.5.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.0.4 tag, from src/wp-includes/pluggable.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.