I have a plugin that requires the user to enter a password (to access an external site) into a form field on the plugin settings page. Right now this is just saved as plain text, but I need to make it more secure. What can I do?

  • Can you please show use the source that you are using. Presumably you have the password field just set up as a standard <input />, as opposed to a special password field '<input type="password" />`? – David Gard Oct 20 '14 at 15:59
  • @DavidGard it's a combination of add_settings_field, a text input, settings_fields(), do_settings_section() (source code). Would using a password field here help? Won't it still write plain text to the database? – Jack Oct 20 '14 at 17:51
  • Yes, it will. It's not really ideal to store passwords as that can lead to security issues down the line. However, if you must, you can make use of the wp_hash_password function. That should be enough to get you started, but again I say I wouldn't recommend it... – David Gard Oct 21 '14 at 9:16

Don't do it? Passwords meant to be remembered not stored, and once you store them in extractable format (i.e. without hashing or other sort of many to one transformation) they become a less effective security measure.

As with any security related question, you have to start with defining what is it that you trying to protect against and only then you can decide how to set up your protection. If you store the password on your own hardware at home there is probably no problem with storing them as plain text (not much more then storing them in an excel file) but if you store it in some free hosting and you are in the habit of installing plugins without doing a security audit then probably nothing you can think of will be secure enough.

  • 1
    unfortunately that doesn't help- the password is required to allow the plugin to access a third-party service, so it has to be stored somewhere – Jack Oct 20 '14 at 17:43
  • 1
    Doesn't help whome? If you will not write the plugin maybe some people's passwords will not be stolen which will actually help them. If the design of the plugin is insecure then there is not much point of trying to have some aspect of it to be somewhat more secure, just save yourself some coding time and keep the passwords as regular plain text in the DB. – Mark Kaplun Oct 20 '14 at 18:09

The hard truth here is: You can not. Every encryption method that has to be decrypted on-the-run is insecure. You write that the password has to be stored to access a third-party-service. So this password has to be decrypted at the runtime to access the service. This means that someone who gets to access your database or backend to read out wherever you stored it will probably be able to decrypt it.

If you want to make it safer, you can not do that much. Check if the service provides another access method, like OAuth 2 or similar.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.