Rotate Authorize.Net Transaction and Signature Keys After a WordPress Compromise
Authorize.Net lets merchants keep an old transaction or signature key alive for 24 hours or kill it at once. After a WordPress compromise, its documentation points to the immediate cutoff, and the signature key change has to be matched in webhook code so notifications keep arriving.