001 / DOCS

Security and Encryption

Security features in Ingestics: encrypted credential storage, SSRF protection, and diagnostic masking.

Encrypted credential storage

All API keys, passwords, tokens, and client secrets are encrypted with AES-256-CBC before being stored in the WordPress database. The encryption key is derived from your site’s AUTH_KEY and AUTH_SALT constants in wp-config.php.

Encrypted fields include:

• API keys (query parameter and header types)
• Bearer tokens
• Basic Auth passwords
• OAuth2 client secrets and refresh tokens
• OpenAI, Anthropic, Gemini, DeepL API keys
• AWS access key secret
• Any custom header values marked as sensitive

Credentials are never stored in plaintext, never logged, and never exposed in the database.

SSRF protection

Server-Side Request Forgery (SSRF) protection blocks requests to internal network addresses:

• Private IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• Loopback addresses (127.x.x.x, ::1)
• Link-local addresses (169.254.x.x)
• Cloud metadata endpoints (169.254.169.254)
• Any hostname that resolves to a private IP address

SSRF protection is always enabled and cannot be disabled.

Diagnostic masking

When Ingestics logs diagnostic information, all sensitive data is masked:

• Authorization: Bearer ***
• X-API-Key: ***
• password=***

This ensures that log files and diagnostic screens do not expose credentials.

Nonce verification

All Ingestics admin actions require WordPress nonces. This prevents Cross-Site Request Forgery (CSRF) attacks. Without a valid nonce, Ingestics will not perform any action.

Credential redaction on export

When you export your Ingestics configuration (Pro+), all credentials are redacted. The export file contains the provider configuration, field mappings, and settings — but not the actual credentials.

This is important for:

• Staging/production sync — Export from production, import to staging. Staging has the same configuration but no credentials.
• Backup — Your backup file does not contain credentials, so even if it is leaked, your APIs are safe.
• Version control — You can commit the export file to git without leaking secrets.

HTTPS enforcement

Ingestics always uses HTTPS for API requests when the endpoint supports it. Never configure an API provider with an HTTP (non-HTTPS) URL for sensitive data.

Security checklist

1. Use encrypted credential storage (automatic in Ingestics)
2. Rotate API keys every 3-6 months
3. Use the principle of least privilege when creating API keys
4. Keep SSRF protection enabled (always on)
5. Audit your wp-config.php keys — regenerate if copied from a tutorial
6. Protect your database with strong passwords and localhost-only access
7. Use HTTPS for all API requests
8. Monitor for unexpected API usage

Comparison with other plugins

For a deeper dive, read our blog post: How to Securely Store API Credentials in WordPress.