---
title: Protect Your Feed URL with the Security Key
description: Protect your WooCommerce product feed URL with the Security Key so only your cron job can regenerate it.
url: "https://wpfactory.com/docs/protect-your-feed-url-with-security-key/"
updated: "2026-09-27"
category: References
---

# Protect Your Feed URL with the Security Key

[Product XML Feeds Manager for WooCommerce](https://wpfactory.com/item/product-xml-feeds-woocommerce/) can regenerate a feed from an external URL, which is what makes server cron jobs possible. The Security Key is what stops just anyone from triggering that regeneration. This reference explains what the key is, where it lives, and how it protects the external feed-generation URL.

### Where the key lives

The **Security Key** field (`alg_products_xml_feeds_security_key`) is in the **Advanced Options** group of the **General** section, under **WPFactory > Product XML Feeds** (also reachable at **WooCommerce > Settings > Product XML Feeds**). It is generated automatically, so you normally never touch it.

[![Advanced Options group with the Security Key field](https://wpfactory.com/wp-content/uploads/product-xml-1024x483.png)](https://wpfactory.com/wp-content/uploads/product-xml.png)

### How it protects the external URL

There are two ways a feed is regenerated:

- **Inside the admin**, the **Create now** button uses your logged-in session and a WordPress nonce. It requires the `manage_woocommerce` capability.
- **Externally**, a cron job calls `admin-ajax.php` with the action `alg_wc_product_xml_feeds_generate_xml_external`. Because a cron job is not logged in, this request must carry a `secret` parameter instead.

The plugin accepts the external request only when the `secret` parameter matches a hash of your Security Key (`wp_hash()` of `alg_products_xml_feeds_security_key`). A wrong or missing secret is rejected with a "403 Invalid secret key" response, so the raw key never travels in the URL and the feed cannot be regenerated by an unauthorized caller.

### The manual cron command already includes it

You do not build the hashed secret yourself. The **Manual Cron Job Command** group in each feed section shows the full command with the correct `secret` value already filled in:

```
wget -qO- https://your-store.com/wp-admin/admin-ajax.php?action=alg_wc_product_xml_feeds_generate_xml_external&secret=HASHED_KEY&alg_create_products_xml=1 >/dev/null 2>&1
```

Copy that command as shown. See [Schedule Automatic Feed Updates and Use a Manual Cron Job](https://wpfactory.com/docs/product-xml-feeds-manager/) for adding it to your server's crontab.

### Regenerating the key

You can overwrite the Security Key with a new value and save, but only do so if you have a reason to (for example you believe the old value leaked). Regenerating it changes the hashed `secret`, so you must update any saved cron command with the new one shown on the settings screen, or the external call will start returning 403.

### Related articles

- [Schedule Automatic Feed Updates and Use a Manual Cron Job](https://wpfactory.com/docs/product-xml-feeds-manager/)
- [Generate Your Feed and Find Its URL](https://wpfactory.com/docs/product-xml-feeds-manager/)

### Need a hand?

Our team answers every ticket on the [Product XML Feeds support forum](https://wpfactory.com/support/item/product-xml-feeds-woocommerce/).

Related articles

- [Generate Your Feed and Find Its URL](https://wpfactory.com/docs/generate-your-feed-and-find-its-url/)
- [How to Add WooCommerce Brands to a Product XML Feed](https://wpfactory.com/docs/xml-feed-woocommerce-brands/)
- [Schedule Automatic Feed Updates and Use a Manual Cron Job](https://wpfactory.com/docs/schedule-automatic-feed-updates/)
- [Product XML Feeds: Developer Hooks and Filters Reference](https://wpfactory.com/docs/product-xml-feeds-developer-hooks-filters/)
- [Create Multiple XML Feeds](https://wpfactory.com/docs/create-multiple-xml-feeds/)