As of WordPress 4.4.0, wp_rand() is fine. https://paragonie.com/blog/2015/10/coming-wordpress-4-4-csprng https://paragonie.com/blog/2015/10/coming-wordpress-4-

As of WordPress 4.4.0, wp_rand() is fine. https://paragonie.com/blog/2015/10/coming-wordpress-4-4-csprng https://paragonie.com/blog/2015/10/coming-wordpress-4-4-cspr... I had already suggested (to Dion Hulse) that this antipattern of pinging wordpress.org to define the salts during setup be removed in favor of always generating them locally. I don't know if/when they'll implement that (no matter what benefits a security fix might provide, WordPress always prioritizes "no BC breaks even on 0.0001% of the installed base" first), but if you're looking for a more secure CMS I happen to be building one here: https://github.com/paragonie/airship https://github.com/paragonie/airship