Rotate a compromised key
Replacing a license key that has been exposed. This is a deliberate, disruptive action — read it before you use it.
What rotation does
Generates a new license key and immediately invalidates the current one. The account confirms before doing it:
Rotating generates a new key and immediately invalidates the current one on all your sites. Continue?
And afterwards:
Your license key was rotated. The previous key stopped working immediately; update it on your sites.
There is no grace period and no undo.
What breaks the moment you rotate
Every site running the old key stops validating. That means:
- No more update offers.
- Anything the product gates behind a valid license stops.
The site keeps running the files it has installed. It is not deleted, disabled or broken — it is unlicensed until you paste the new key.
When to rotate
| Situation | Rotate? |
|---|---|
| The key was published, committed to a repository, or posted in a ticket | Yes, now |
| A former colleague, agency or contractor has it | Yes |
| Your domain count is rising and you cannot account for the sites | Yes — after removing the unknown domains |
| A site is refusing the key | No. Rotation does not fix a rejection and will break your other sites |
| You want a "fresh start" | No |
Rotation is a security action, not a troubleshooting step.
Do it in the right order
- List every site using the license. The domain list on the card is your inventory.
- Make sure you can reach each site's administration now, not later.
- Pick a quiet moment. All of them go unlicensed at once.
- Rotate. The new key is revealed immediately after.
- Copy it, and paste it on each site.
- Remove any domain you do not recognize while you are there.
Step 1 matters most. Rotating first and then discovering you cannot get into a site is how a five-minute job becomes a day.
The new key is shown once
Right after rotation the new key is displayed, so copy it then. If you navigate away, reveal it again from the card the normal way — nothing is lost, it is just an extra step.
After rotating
- Confirm each site validates again.
- Confirm the domain list looks the way you expect.
- Change how the key is stored, so the exposure does not repeat: the account is the authoritative copy, and a password manager is the only reasonable second place.
What rotation does not do
- It does not remove domains. Deactivate those separately.
- It does not change your plan, your allowance or your renewal date.
- It does not affect your credits, services or commissions.
- It does not tell you who used the old key.