--- title: Proposal: A Secrets API for WordPress 7.2 | daily.dev description: A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the... canonical: https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Proposal: A Secrets API for WordPress 7.2 | daily.dev og:description: A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the... og:url: https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk og:image: https://api.daily.dev/og/posts/rCwr8dGQk.png og:image:alt: Proposal: A Secrets API for WordPress 7.2 og:image:width: 1200 og:image:height: 630 og:locale: en --- [Make WordPress Core](https://daily.dev/sources/wordpresscore) [Read post](https://api.daily.dev/r/rCwr8dGQk) # [Proposal: A Secrets API for WordPress 7.2](https://api.daily.dev/r/rCwr8dGQk "Go to post") A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the options table. The design includes wp\_set\_secret/wp\_get\_secret/wp\_delete\_secret functions, always-on envelope encryption, two version slots for rotation, multisite support, replaceable storage and keyring drop-ins, and no filter hooks on retrieval to prevent interception. WP-CLI support ships alongside it, but the admin UI is deferred to 7.3\. A feature plugin will be published first so contributors can test the API before it lands in core, targeting Beta 1 on October 20-22\. The author explicitly scopes what the API defends against (database dumps, backups, SQL injection reads) versus what it does not (code execution within the WordPress process). [#architecture](/tags/architecture "Check all #architecture posts")[#php](/tags/php "Check all #php posts")[#wordpress](/tags/wordpress "Check all #wordpress posts")[#encryption](/tags/encryption "Check all #encryption posts")[#secrets-management](/tags/secrets-management "Check all #secrets-management posts") Aug 25•12m read time•From [make.wordpress.org](https://api.daily.dev/r/rCwr8dGQk "make.wordpress.org") [](https://api.daily.dev/r/rCwr8dGQk "Go to post") Table of contents [Why it matters](https://api.daily.dev/r/rCwr8dGQk "Why it matters")[Clarifying priorities](https://api.daily.dev/r/rCwr8dGQk "Clarifying priorities")[Proposed API](https://api.daily.dev/r/rCwr8dGQk "Proposed API")[What this does and does not do](https://api.daily.dev/r/rCwr8dGQk "What this does and does not do")[Prior art](https://api.daily.dev/r/rCwr8dGQk "Prior art")[Timeline](https://api.daily.dev/r/rCwr8dGQk "Timeline")[Feedback wanted](https://api.daily.dev/r/rCwr8dGQk "Feedback wanted")[Share this:](https://api.daily.dev/r/rCwr8dGQk "Share this:") Questions this post answers How will the proposed WordPress Secrets API store and encrypt credentials? Secrets would be encrypted at rest under a master-key envelope, with a per-secret data key wrapped by a master key, using functions like wp\_set\_secret() and wp\_get\_secret(). Encryption is not optional and there is no plaintext mode. Default storage uses the options table as ciphertext blobs with autoload=no, excluded from options.php and the REST settings endpoint, with storage and keyring pluggable via a secrets.php drop-in. Track how core secrets management evolves as WordPress plugin authors weigh in via daily.dev. Why doesn't the proposed WordPress Secrets API allow filters on secret retrieval? No filter is applied to a secret on its way out of storage because a retrieval filter would, by construction, be a hook that receives every credential on the site in plaintext, making it a documented interception point that any plugin could register to steal credentials. Instead, flexibility is provided through explicit, replaceable storage and keyring providers rather than filters. Follow this kind of security-tradeoff reasoning behind plugin API design on daily.dev. When is WordPress 7.2 Beta 1 expected and what does that mean for the Secrets API proposal? Beta 1 for WordPress 7.2 is scheduled for October 20-22, which serves as the practical deadline for the Secrets API to land in that release. A feature plugin is planned for testing from now through mid-September, a Trac patch matching the plugin's API surface in late September, and a decision to commit or defer to 7.3 before Beta 1\. Keep tabs on WordPress core release milestones like this one through daily.dev. 2.8K Impressions Comment Bookmark Copy Share your thoughtsPost [](https://daily.dev/sources/wordpresscore) [Make WordPress Core](https://daily.dev/sources/wordpresscore "https://daily.dev/sources/wordpresscore") WordPressCore's platform is a central hub for WordPress developers and contributors, offering insigh... Read more 427 Followers • 1.4K Upvotes #### Would you recommend this post? Copy link WhatsApp Facebook X New Squad Copy linkShare with your friends ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Proposal: A Secrets API for WordPress 7.2","url":"https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk"},"datePublished":"2026-08-25T21:27:27.195Z","dateModified":"2026-08-25T22:45:22.399Z","description":"A proposal for WordPress 7.2 introduces a first-class Secrets API to replace the current practice of storing API keys and credentials in plaintext in the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ad4f5b66be737a1618019916626b1bd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ad4f5b66be737a1618019916626b1bd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Make WordPress Core","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Make WordPress Core","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/892d1a79e30e4e8a911b5726c6fb1a06","url":"https://daily.dev/sources/wordpresscore"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"architecture,php,wordpress,encryption,secrets-management","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Make WordPress Core","item":"https://daily.dev/sources/wordpresscore"},{"@type":"ListItem","position":3,"name":"Proposal: A Secrets API for WordPress 7.2"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/proposal-a-secrets-api-for-wordpress-7-2-rcwr8dgqk#faq","mainEntity":[{"@type":"Question","name":"How will the proposed WordPress Secrets API store and encrypt credentials?","acceptedAnswer":{"@type":"Answer","text":"Secrets would be encrypted at rest under a master-key envelope, with a per-secret data key wrapped by a master key, using functions like wp_set_secret() and wp_get_secret(). Encryption is not optional and there is no plaintext mode. Default storage uses the options table as ciphertext blobs with autoload=no, excluded from options.php and the REST settings endpoint, with storage and keyring pluggable via a secrets.php drop-in. Track how core secrets management evolves as WordPress plugin authors weigh in via daily.dev."}},{"@type":"Question","name":"Why doesn't the proposed WordPress Secrets API allow filters on secret retrieval?","acceptedAnswer":{"@type":"Answer","text":"No filter is applied to a secret on its way out of storage because a retrieval filter would, by construction, be a hook that receives every credential on the site in plaintext, making it a documented interception point that any plugin could register to steal credentials. Instead, flexibility is provided through explicit, replaceable storage and keyring providers rather than filters. Follow this kind of security-tradeoff reasoning behind plugin API design on daily.dev."}},{"@type":"Question","name":"When is WordPress 7.2 Beta 1 expected and what does that mean for the Secrets API proposal?","acceptedAnswer":{"@type":"Answer","text":"Beta 1 for WordPress 7.2 is scheduled for October 20-22, which serves as the practical deadline for the Secrets API to land in that release. A feature plugin is planned for testing from now through mid-September, a Trac patch matching the plugin's API surface in late September, and a decision to commit or defer to 7.3 before Beta 1. Keep tabs on WordPress core release milestones like this one through daily.dev."}}]} ```