Site keys stay masked until you click Show. The Hub hides whether a guessed Site ID exists. Unknown, wrong, and revoked keys all return the same unauthorized answer. Keys are as safe as your Hub login plus the Show click. This is not unhackable.

If the Hub login may be stolen, sign out other sessions and change the Hub password. Changing the password (or turning on two-factor) revokes every Site key. Site IDs stay. Click Show, copy the new key, and paste it in WordPress Connect. Disconnect keeps the Site ID and kills the old key. Support can re-activate a revoked site; that also mints a new key. We never email a Site key.

Watch raises Site key abuse or Site key stuffing when guesses pile up. Quiet hours do not mute those. A stolen Hub session can still click Site key Show until you sign out other sessions.

Bucket keys and Cloudflare tokens need your Hub password to Show, and 2FA when enrolled. Activity never echoes query strings. You never change DNS. What we keep locking down or Rotate a Site key.