Hi @aces,
WordPress salts don’t expire on their own. They only change if someone manually updates them in wp-config.php, if you migrate the site to a new server, or if a plugin or server process rotates them.
The reason your custom code’s signature becomes invalid is that the salts were changed. This invalidates any existing signatures, which is exactly how code signing is supposed to work, it’s protecting your site from accepting outdated or tampered code. This is not a bug, it’s working exactly as intended.
Instead of disabling code signatures, you should figure out why the salts are changing. It could be that your hosting provider is automatically rotating them (most providers don’t, but you never know). I recommend reaching out to your host to check.
For a full explanation of how code signatures work and why they matter, see: