WordPress Wants to Stop Plugins From Storing Your API Keys as Plain Text

Every plugin that needs an API key today has to store it somewhere, and right now that somewhere is plain text. A new proposal aims to fix that in WordPress 7.2.

What happened

WordPress currently has no built-in way to store a credential securely. Plugins write API keys straight into the database’s options table, the same place that holds your site tagline, in plain text. That means the key ends up in every database dump, every backup, every staging clone, and anywhere someone runs a command to inspect site options. Plugins like Site Kit and WooCommerce payment gateways have each built their own workaround, but every one of those is a separate security risk that no one reviews on behalf of the whole WordPress ecosystem.

The proposal, written by developer Eric Mann, would add a first-class Secrets API to WordPress core. Plugins would store credentials through it instead of writing them into regular settings. Encryption would be mandatory, with no plain-text option, and each secret would get its own encryption key so keys can be rotated without re-encrypting everything. The stored values would be excluded from the site’s regular settings pages and REST API, and existing plugins could migrate their old plain-text keys into the new system.

The proposal also adds WP-CLI support for secrets in version 7.2 itself, so developers managing a site from the command line don’t need to pass credentials in ways that leak into shell history.

Why this matters

The risk has grown because more plugins now connect to AI services, and a leaked API key for a metered AI provider can turn into a real, ongoing bill for the site owner, not just a security embarrassment. A first-class way to store credentials means fewer sites leaking those keys through routine backups and staging clones.

What to expect

This is a proposal, not a shipped feature. There’s no admin screen for managing secrets yet; that’s intentionally deferred to WordPress 7.3 so the underlying storage system can prove itself first. The WordPress community can weigh in on the proposal through mid-September, with a decision on whether it lands in core expected before the 7.2 beta in October. Site owners don’t need to do anything yet, but plugins you use may eventually ask you to re-save an API key so it can move into the new, encrypted storage.

End of article