Your stored GoCardless access tokens (and any other encrypted plugin data) become permanently unreadable, and you'll need to reconnect. Here's why: encryption always uses a 32-byte key — either WPDIRECTDEBIT_SALT if you've defined it in wp-config.php, or, if you haven't, a hash of WordPress's own AUTH_KEY. That fallback means encryption works out of the box with zero setup, which is great for sandbox testing, but it also means your credentials are only as stable as AUTH_KEY. If you ever regenerate WordPress's secret keys (a security plugin doing a routine rotation, a fresh salts pull from the WordPress.org secret-key API, restoring wp-config.php from a different environment), and you never defined a dedicated WPDIRECTDEBIT_SALT, the old ciphertext can no longer be decrypted — Crypto::decrypt() just returns an empty string. This is exactly why the plugin nags you to add a dedicated salt before going Live: it decouples your GoCardless credentials from WordPress's own key rotation.