I was looking through a list of steps to take when there is a risk that your site has been hacked. It recommends changing the value of
$drupal_hash_salt in settings.php.
According to the inline comments in settings.php:
Salt for one-time login links and cancel links, form tokens, etc.
This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if your site is deployed on a cluster of web servers, you must ensure that this variable has the same value on each server. If this variable is empty, a hash of the serialized database credentials will be used as a fallback salt.
Can I simply replace the existing value with random string? I am worried that changing this string may adversely effect some other aspect of site functionality.