One of my plugins is using an API key to communicate with an off-page service. However, this API is not encrypted and is therefore visible to everyone with an admin login.

Can I encrypt the API key in the database? And what would be the best practice for doing this?


  • Will be less work to just remove that field from any admin pages. Otherwise, you'll also have to de-crypt it before sending it to the off-page service. – Dan. Dec 1 '16 at 14:38
  • Yeah. Thought about that as well. That would sort the backend issue, however; I would prefer storing it encrypted in the database also. – user2806026 Dec 1 '16 at 14:46
  • Fair enough. It's a bit of work though I think. This question/answer gives a good guide on the available methods in PHP- stackoverflow.com/questions/9262109/… – Dan. Dec 1 '16 at 14:58

There is no point in doing that. Anyone that has access to the DB and the code will be able to decrypt, and the admin is likely to have this kind of access.

  • Why would admin likely have access? You don't have to give your admin users your DB and FTP credentials – Dan. Dec 1 '16 at 19:57
  • @Dan.if an admin do not have access to all aspects of the system than hew is not an admin – Mark Kaplun Dec 2 '16 at 4:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.