A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the options table. The design includes wp_set_secret/wp_get_secret/wp_delete_secret functions, always-on envelope encryption, two version slots for rotation, multisite support, replaceable storage and keyring drop-ins, and no filter hooks on retrieval to prevent interception. WP-CLI support ships alongside it, but the admin UI is deferred to 7.3. A feature plugin will be published first so contributors can test the API before it lands in core, targeting Beta 1 on October 20-22. The author explicitly scopes what the API defends against (database dumps, backups, SQL injection reads) versus what it does not (code execution within the WordPress process).
Table of contents
Why it mattersClarifying prioritiesProposed APIWhat this does and does not doPrior artTimelineFeedback wantedShare this:Questions this post answers
How will the proposed WordPress Secrets API store and encrypt credentials?
Secrets would be encrypted at rest under a master-key envelope, with a per-secret data key wrapped by a master key, using functions like wp_set_secret() and wp_get_secret(). Encryption is not optional and there is no plaintext mode. Default storage uses the options table as ciphertext blobs with autoload=no, excluded from options.php and the REST settings endpoint, with storage and keyring pluggable via a secrets.php drop-in. Track how core secrets management evolves as WordPress plugin authors weigh in via daily.dev.
Why doesn't the proposed WordPress Secrets API allow filters on secret retrieval?
No filter is applied to a secret on its way out of storage because a retrieval filter would, by construction, be a hook that receives every credential on the site in plaintext, making it a documented interception point that any plugin could register to steal credentials. Instead, flexibility is provided through explicit, replaceable storage and keyring providers rather than filters. Follow this kind of security-tradeoff reasoning behind plugin API design on daily.dev.
When is WordPress 7.2 Beta 1 expected and what does that mean for the Secrets API proposal?
Beta 1 for WordPress 7.2 is scheduled for October 20-22, which serves as the practical deadline for the Secrets API to land in that release. A feature plugin is planned for testing from now through mid-September, a Trac patch matching the plugin's API surface in late September, and a decision to commit or defer to 7.3 before Beta 1. Keep tabs on WordPress core release milestones like this one through daily.dev.