<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk" -->

---
title: Proposal: A Secrets API for WordPress 7.2 | daily.dev
description: A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the...
canonical: https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Proposal: A Secrets API for WordPress 7.2 | daily.dev
og:description: A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the...
og:url: https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk
og:image: https://api.daily.dev/og/posts/rCwr8dGQk.png
og:image:alt: Proposal: A Secrets API for WordPress 7.2
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Proposal: A Secrets API for WordPress 7.2

**[Make WordPress Core](https://daily.dev/sources/wordpresscore)** · 12 min read · 3 upvotes · 0 comments

## Summary

A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the options table. The design includes wp_set_secret/wp_get_secret/wp_delete_secret functions, always-on envelope encryption, two version slots for rotation, multisite support, replaceable storage and keyring drop-ins, and no filter hooks on retrieval to prevent interception. WP-CLI support ships alongside it, but the admin UI is deferred to 7.3. A feature plugin will be published first so contributors can test the API before it lands in core, targeting Beta 1 on October 20-22. The author explicitly scopes what the API defends against (database dumps, backups, SQL injection reads) versus what it does not (code execution within the WordPress process).

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://make.wordpress.org/core/2026/08/25/proposal-a-secrets-api-for-wordpress-7-2>

## Questions this post answers

### How will the proposed WordPress Secrets API store and encrypt plugin credentials in version 7.2?

Secrets are stored as ciphertext in the options table by default (autoload=no, excluded from options.php and the REST settings endpoint) under mandatory encryption using a per-secret data key wrapped by a master key. There is no plaintext mode. Functions include wp_set_secret(), wp_get_secret(), wp_delete_secret(), and wp_import_option_as_secret(), with storage and keyring as separately replaceable drop-in extension points.

_Developers tracking how WordPress core handles credential storage can follow proposals like this on daily.dev._

### Why does the proposed WordPress Secrets API not allow a filter hook on secret retrieval?

A filter on secret retrieval would be a hook that receives every credential on the site in plaintext, meaning any plugin registering it could intercept and steal credentials. Instead, flexibility is provided through explicit, replaceable storage and keyring providers via a secrets.php drop-in, so no endpoint, filter, or capability other than the API call itself can return a secret's value.

_Anyone weighing security trade-offs in WordPress plugin architecture can follow this kind of design debate on daily.dev._

### What is the timeline for the WordPress 7.2 Secrets API proposal to land in core?

Feedback and a published feature plugin run from now through mid-September, a Trac patch matching the plugin's API surface follows in late September, and the feature must be committed or explicitly deferred to 7.3 before Beta 1, which is scheduled for October 20-22. The author has volunteered to implement the work directly rather than hand it off.

_WordPress developers planning around the 7.2 release cycle can track proposals like this one on daily.dev._

## Similar posts on daily.dev

- [Stop Putting Secrets in .env Files](https://daily.dev/posts/stop-putting-secrets-in-env-files-yml3clr0r) · Lobsters · 2 upvotes · 0 comments

---

Tags: [#architecture](https://daily.dev/tags/architecture), [#php](https://daily.dev/tags/php), [#wordpress](https://daily.dev/tags/wordpress), [#encryption](https://daily.dev/tags/encryption), [#secrets-management](https://daily.dev/tags/secrets-management)

[View this post on daily.dev](https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Proposal: A Secrets API for WordPress 7.2","url":"https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk"},"datePublished":"2026-08-25T21:27:27.195Z","dateModified":"2026-09-13T18:33:42.027Z","description":"A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ad4f5b66be737a1618019916626b1bd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ad4f5b66be737a1618019916626b1bd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Make WordPress Core","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Make WordPress Core","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/892d1a79e30e4e8a911b5726c6fb1a06","url":"https://daily.dev/sources/wordpresscore"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"architecture,php,wordpress,encryption,secrets-management","timeRequired":"PT12M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Make WordPress Core","item":"https://daily.dev/sources/wordpresscore"},{"@type":"ListItem","position":3,"name":"Proposal: A Secrets API for WordPress 7.2"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk#faq","mainEntity":[{"@type":"Question","name":"How will the proposed WordPress Secrets API store and encrypt plugin credentials in version 7.2?","acceptedAnswer":{"@type":"Answer","text":"Secrets are stored as ciphertext in the options table by default (autoload=no, excluded from options.php and the REST settings endpoint) under mandatory encryption using a per-secret data key wrapped by a master key. There is no plaintext mode. Functions include wp_set_secret(), wp_get_secret(), wp_delete_secret(), and wp_import_option_as_secret(), with storage and keyring as separately replaceable drop-in extension points. Developers tracking how WordPress core handles credential storage can follow proposals like this on daily.dev."}},{"@type":"Question","name":"Why does the proposed WordPress Secrets API not allow a filter hook on secret retrieval?","acceptedAnswer":{"@type":"Answer","text":"A filter on secret retrieval would be a hook that receives every credential on the site in plaintext, meaning any plugin registering it could intercept and steal credentials. Instead, flexibility is provided through explicit, replaceable storage and keyring providers via a secrets.php drop-in, so no endpoint, filter, or capability other than the API call itself can return a secret's value. Anyone weighing security trade-offs in WordPress plugin architecture can follow this kind of design debate on daily.dev."}},{"@type":"Question","name":"What is the timeline for the WordPress 7.2 Secrets API proposal to land in core?","acceptedAnswer":{"@type":"Answer","text":"Feedback and a published feature plugin run from now through mid-September, a Trac patch matching the plugin's API surface follows in late September, and the feature must be committed or explicitly deferred to 7.3 before Beta 1, which is scheduled for October 20-22. The author has volunteered to implement the work directly rather than hand it off. WordPress developers planning around the 7.2 release cycle can track proposals like this one on daily.dev."}}]}
```