I was looking through a list of steps to take when there is a risk that your site has been hacked. It recommends changing the value of $drupal_hash_salt in settings.php.

According to the inline comments in settings.php:

Salt for one-time login links and cancel links, form tokens, etc.

This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if your site is deployed on a cluster of web servers, you must ensure that this variable has the same value on each server. If this variable is empty, a hash of the serialized database credentials will be used as a fallback salt.

Can I simply replace the existing value with random string? I am worried that changing this string may adversely effect some other aspect of site functionality.

1 Answer 1


Disruption should be minimal -- the salt value was designed to be changeable. As it says, it will invalidate one-time login links when the salt is changed. But if you suspect that you've been hacked, this is precisely what you want to happen.

  • So if I change it then any one-time login links previous to the change will be invalid. However, any one-time login link generated after changing $drupal_hash_salt should work as per normal. Is that correct?
    – Benjen
    Commented Apr 1, 2015 at 23:10
  • 1
    Yes that is correct.
    – Darvanen
    Commented Apr 2, 2015 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.