Good security hygiene recommends changing secret keys periodically. However, changing a key abruptly can cause temporary website errors if the server and the proxy aren't updated at the exact same second. WebOptiva eliminates this headache with dual-secret rotation.

How zero-downtime secret rotation works#

1. Stage a New Secret: In the Origin Shield tab, click Rotate Secret. WebOptiva reveals a new staged secret while your current active secret continues signing all live traffic.
2. Update Your Server: Give the new staged secret to your developer so your web host accepts both the old and new secret.
3. Test with the Probe: Click Test Direct Bypass to confirm your origin still rejects raw requests while accepting signed traffic.
4. Promote the Secret: Click Promote to Active (15m Grace). WebOptiva immediately begins signing all visits with the new secret and keeps accepting the previous secret for 15 minutes so in-flight requests drain safely.
5. Retire the Old Secret: Once the grace window ends, your developer can remove the retired secret from your server.

This safe, orderly sequence guarantees that your website stays 100% online throughout the entire secret refresh process.