We have set up a Craft 3 installation with composer to serve as boilerplate for a number of upcoming projects. The installation sits in a private git repository and the plan is to clone it when we start a new project.

Everything works fine, but since new projects will spawn from the boilerplate, the Security Key is the same for all of them - which probably is a bad idea.

Is there a way to assign a new security key when we clone the boilerplate for a new project? Are there other security considerations to take into account?

Thanks a lot!

1 Answer 1


You can run the craft setup/security-key console command after cloning the repo. That'll generate a security key for that Craft install and put it in the local .env file.

Or for that matter, craft setup will run the whole setup process (database credeitials, security key, etc.).

Are there other security considerations to take into account?

Keep your craft/config/license.key out of the repo so that a new one is generated for each cloned site.

  • Works perfectly, thanks a lot, also for the hint about the license key.
    – Anthronaut
    Commented Mar 22, 2018 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.