<![CDATA[Where the COOKIEHASH comes from ?]]>I saw in my wp-config.php a COOKIEHASH which suppose to be (if I understood well) a md5 of siteurl

the one generated in my wp-config is not a md5 valid
I means it contain invalid characters such as g-z
example: define( 'COOKIEHASH', md5('iNhg1WZsm5nYEHY9OYsKyhFJ7yo4B53s') );

]]>https://forum.cloudron.io/topic/3521/where-the-cookiehash-comes-fromRSS for NodeTue, 21 Jul 2026 00:55:21 GMTSun, 25 Oct 2020 03:20:06 GMT60<![CDATA[Reply to Where the COOKIEHASH comes from ? on Mon, 26 Oct 2020 15:51:12 GMT]]>@JOduMonT said in Where the COOKIEHASH comes from ?:

so this code is not generated by the WordPress installation and it is a parameter Cloudron added for more security ?

Yes, we added it in the package. I installed a whole bunch of security plugins like WP Fence, SecuPress and what not and ran all the scans. One of the scan suggested that this be set to a more random value than the default for more security. Currently, this is only set for new installations.

]]>https://forum.cloudron.io/post/17140https://forum.cloudron.io/post/17140Mon, 26 Oct 2020 15:51:12 GMT<![CDATA[Reply to Where the COOKIEHASH comes from ? on Mon, 26 Oct 2020 15:55:39 GMT]]>@girish That makes sense why it wasn’t in mine. I’m planning to reinstall anyway for LDAP support so I’ll let your install script add the custom COOKIEHASH for me. ☺️

]]>https://forum.cloudron.io/post/17143https://forum.cloudron.io/post/17143Mon, 26 Oct 2020 15:55:39 GMT<![CDATA[Reply to Where the COOKIEHASH comes from ? on Mon, 26 Oct 2020 15:51:12 GMT]]>@JOduMonT said in Where the COOKIEHASH comes from ?:

so this code is not generated by the WordPress installation and it is a parameter Cloudron added for more security ?

Yes, we added it in the package. I installed a whole bunch of security plugins like WP Fence, SecuPress and what not and ran all the scans. One of the scan suggested that this be set to a more random value than the default for more security. Currently, this is only set for new installations.

]]>https://forum.cloudron.io/post/17140https://forum.cloudron.io/post/17140Mon, 26 Oct 2020 15:51:12 GMT<![CDATA[Reply to Where the COOKIEHASH comes from ? on Mon, 26 Oct 2020 03:31:35 GMT]]>@JOduMonT I have the Developer Edition and it’s not in mine?

]]>https://forum.cloudron.io/post/17109https://forum.cloudron.io/post/17109Mon, 26 Oct 2020 03:31:35 GMT<![CDATA[Reply to Where the COOKIEHASH comes from ? on Mon, 26 Oct 2020 01:02:18 GMT]]>@Lonk thanks for the clarification
so this code is not generated by the WordPress installation and it is a parameter Cloudron added for more security ?

]]>https://forum.cloudron.io/post/17107https://forum.cloudron.io/post/17107Mon, 26 Oct 2020 01:02:18 GMT<![CDATA[Reply to Where the COOKIEHASH comes from ? on Sun, 25 Oct 2020 15:52:13 GMT]]>There are best practices but the COOKIEHASH can be anything. I see 3 potential reasons for changing it:

• Block bot attempted Logins with the custom cookie constant

• Two installations can potentially (but unlikely) have a conflict in the login (cannot be logged into both at once in the same browser instance). This solves that!

• Security through obscurity as this is one less thing to identify your site as run by Wordpress

That’s all I’ve got. I never customized mine, but after writing about it I think I will. Thanks for bringing this up!

]]>https://forum.cloudron.io/post/17093https://forum.cloudron.io/post/17093Sun, 25 Oct 2020 15:52:13 GMT