This is the code in settings.php

$drupal_hash_salt = '';

From what I know it should be a random string and I shouldn't change it at all and it has a direct effect on the website security. But why this variable is empty? Is there any problem and what should I do to assign a string to this variable?

  • Why do you think you shouldn't change it? In case of a breach, do change this value.
    – AKS
    Commented May 29, 2014 at 17:55

1 Answer 1


The hash is used to salt things one-time links and forms tokens, it filed usually by the installer.

You can add your own salt here, basically any random string or even replace it with the content of a file (see the documentation in the default.settings.php).

If this variable is empty, a hash of the serialized database credentials will be used as a fallback salt (though you have to add it manually if you have a database cluster).

This is function used as a fall back if there is no salt drupal_hash_salt

function drupal_get_hash_salt() {
  global $drupal_hash_salt, $databases;
  // If the $drupal_hash_salt variable is empty, a hash of the serialized
  // database credentials is used as a fallback salt.
  return empty($drupal_hash_salt) ? hash('sha256', serialize($databases)) : $drupal_hash_salt;
  • so you mean it is not a security hole? yes ?
    – M a m a D
    Commented May 29, 2014 at 17:46
  • 1
    no since the hash is the seeded with your database connection string it is unique to that site. and you can run the code hash('sha256', serialize($databases)) and add the output to settings.php
    – m.khamash
    Commented May 29, 2014 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.