Rotating WordPress security salts has one precise security effect: cookies and nonces created with the old secrets stop validating. That can end stolen or untrusted browser sessions after incident cleanup, a leaked wp-config.php, or an ownership handoff. It does not remove malware, reset account passwords, or automatically ...