WordPress 7.2 will include a built-in way to store credentials encrypted. The new Secrets API is described in the WordPress 7.2 developer note.
What it does
Many plugins save API keys and OAuth client secrets in the database. OAuth secrets are the passwords that connect your site to services like payment or email providers.
The Secrets API gives plugins a standard function to store those values encrypted. It also keeps one previous version, so a plugin can rotate a key without losing the old one right away.
What it does not do
The WordPress team is clear on one limit. Plugin name prefixes stop plugins from overwriting each other’s secrets. They are not access control. Any code running on your site can still read any secret.
So a malicious or vulnerable plugin on your site is still a risk. Encryption helps most if someone gets a copy of your database.
What site owners should do
You do not need to change anything. Plugins must choose to use the API.
- Ask the vendors of plugins that hold payment, email, or CRM keys whether they plan to adopt it.
- Keep removing plugins you no longer use.
- If you tested an earlier 7.2 beta or created a
secrets.phpfile, read the breaking changes in the developer note before upgrading.
If a secret exists but cannot be read, for example because the encryption key is unavailable, the API reports an error. Developers are told not to ask users for a new credential in that case, since the old one may still work.
End of article