How to Store API Keys Safely in wp-config.php

 

API keys help WordPress connect with services such as Brevo, Stripe, Google Maps, and other platforms. Placing a secret inside a plugin file, functions.php, Elementor Custom Code, or a public repository can expose it. This guide explains How to Store API Keys Safely in wp-config.php, retrieve them from custom PHP, and reduce accidental disclosure.

WordPress loads wp-config.php during startup, but a correctly configured server does not normally display it publicly. This is better than theme or plugin code, although it is not completely secure.

What Is an API Key?

An API key is a credential that identifies and authorizes a website when it connects to another service. A form may use a Brevo key to send email, while a map plugin may use a Google Maps key to load location data.

Treat an API key like a password. Depending on its permissions, an exposed key could allow unauthorized requests, use paid services, access data, or create unexpected charges.

Why You Should Not Store API Keys in Plugin or Theme Files

Hardcoding credentials inside functions.php, a plugin, or Elementor code increases exposure risk. Updates can overwrite code, developers may share files for support, and backups may be stored insecurely.

Never place secrets in client-side JavaScript because visitors can inspect page source and browser developer tools. Public GitHub repositories, screenshots, tutorials, support messages, and debug logs can also reveal credentials.

Database storage is not automatically safe. A poorly designed plugin may display the value, include it in an export, or expose it through weak access controls.

How to Store API Keys Safely in wp-config.php

Follow these steps carefully:

1. Back up the website and wp-config.php. Keep a downloadable copy so you can restore it after a syntax error.
2. Use secure access. Open the hosting File Manager over HTTPS, use SFTP, or use another secure method supported by your host.
3. Open the WordPress root directory. It normally contains wp-admin, wp-content, and wp-includes.
4. Locate and open wp-config.php in a plain-text editor.
5. Find this line:

/* That's all, stop editing! Happy publishing. */

6. Add the key above it:

define( 'BREVO_API_KEY', 'paste-your-api-key-here' );

Save the file, then check the website frontend and dashboard.

Warning: Never publish your real API key in tutorials, screenshots, comments, support messages, public code, or GitHub repositories. Replace it with a placeholder before sharing any example.

How to Store API Keys Safely in wp-config.php Using a Constant

A PHP constant is a named value available after WordPress loads the configuration file. A clear constant name lets a plugin retrieve the secret without storing it inside the plugin.

define( 'BREVO_API_KEY', 'your-brevo-api-key' );
define( 'GOOGLE_MAPS_API_KEY', 'your-google-maps-api-key' );
define( 'CUSTOM_SERVICE_API_KEY', 'your-service-api-key' );

Use unique names written in uppercase with underscores. Add only the constants your site needs, and match each name exactly in your plugin code.

How to Access the API Key in a WordPress Plugin

Use a defensive check:

$api_key = defined( 'BREVO_API_KEY' ) ? BREVO_API_KEY : '';

if ( empty( $api_key ) ) {
    error_log( 'Brevo API key is not configured.' );
    return;
}

defined() checks whether the constant exists. Its value is assigned to $api_key; otherwise, an empty string stops the function.

The error message does not contain the key. Never print a secret in logs because logs may be copied, downloaded, or viewed by other administrators.

A shorter version is:

if ( defined( 'BREVO_API_KEY' ) ) {
    $api_key = BREVO_API_KEY;
}

The defensive version is preferable for production because it handles missing configuration clearly.

Example: Using the Stored Key in a Brevo API Request

This example passes the stored key to Brevo through the WordPress HTTP API:

$api_key = defined( 'BREVO_API_KEY' ) ? BREVO_API_KEY : '';

if ( empty( $api_key ) ) {
    error_log( 'Brevo API key is not configured.' );
    return;
}

$response = wp_remote_post(
    'https://api.brevo.com/v3/smtp/email',
    array(
        'headers' => array(
            'accept'       => 'application/json',
            'api-key'      => $api_key,
            'content-type' => 'application/json',
        ),
        'body' => wp_json_encode(
            array(
                'sender' => array(
                    'name'  => 'Example Website',
                    'email' => 'sender@example.com',
                ),
                'to' => array(
                    array(
                        'email' => 'recipient@example.com',
                        'name'  => 'Example Recipient',
                    ),
                ),
                'subject'     => 'Example API Request',
                'htmlContent' => '<p>This is placeholder content.</p>',
            )
        ),
        'timeout' => 20,
    )
);

if ( is_wp_error( $response ) ) {
    error_log( 'Brevo request failed: ' . $response->get_error_message() );
}

The key remains in server-side PHP and is added to the request header when WordPress contacts Brevo. After securing your credentials, follow How to Connect Elementor Form With Brevo API to send Elementor submissions to Brevo.

Is wp-config.php Completely Secure?

No storage location guarantees complete protection. Keeping a key in wp-config.php usually reduces exposure compared with hardcoding it in replaceable theme or plugin files, but attackers may still reach it through a compromised hosting account, malware, vulnerable plugins, public backups, an exposed repository, or server misconfiguration.

Anyone with File Manager, SFTP, deployment, or server access may read it. Shared staging sites and debug logs add risk. Security requires several protective layers, not one code change.

Additional Security Best Practices

• Protect hosting with a strong unique password and two-factor authentication.
• Use SFTP instead of unencrypted FTP.
• Do not commit wp-config.php, .env, or backups to public repositories.
• Update WordPress, themes, and plugins, and remove unused extensions.
• Grant only the minimum API permissions required.
• Restrict keys by domain, IP address, or service when supported.
• Revoke or rotate an exposed key immediately.
• Keep secrets out of logs, error messages, screenshots, and frontend output.
• Protect backups and limit download access.
• Use environment variables or a hosting secret manager when supported.
• Test configuration changes on staging before editing a live site.

Suitable file permissions depend on the host, server, file owner, and PHP setup. Do not apply one universal value without checking your host’s documentation.

wp-config.php Constants vs Environment Variables

A wp-config.php constant is easy for many beginners and works on traditional hosting. It also separates credentials from the plugin or theme using them.

Environment variables provide stronger separation between application code and credentials, especially on managed or cloud platforms. Support depends on the hosting and deployment setup, and some hosts offer a dedicated secrets manager. Use the strongest method your environment supports correctly.

Common Mistakes to Avoid

• Constant added after the stop-editing line: Move it above that line.
• Curly quotation marks: Replace them with straight quotes.
• Missing semicolon: End the define() line with ;.
• Wrong constant name: Match spelling and capitalization exactly.
• Key printed on the frontend: Remove it from HTML, JavaScript, and debug output.
• Full configuration file shared: Share only a sanitized excerpt.
• Exposed key left active: Revoke or rotate it immediately.
• No backup created: Restore your saved copy when an error occurs.
• Real key used in a tutorial: Replace it with a placeholder.
• Key stored in JavaScript: Move the request to server-side PHP.

Troubleshooting

The Website Displays a Critical Error

Restore the backup through File Manager or SFTP. Check for missing semicolons, mismatched quotes, or code inserted in the wrong location.

The Constant Is Not Detected

Confirm it is above the stop-editing line and that the name matches exactly. Clear server caches if your host uses persistent caching.

The API Returns Unauthorized or Invalid Key

Copy the key again, remove accidental spaces, confirm it is active, and verify that you are using the correct credential type and endpoint.

It Works on Staging but Not on the Live Website

The live installation has a separate wp-config.php. Add the constant there securely and confirm the live key has the necessary permissions.

The Key Was Exposed Accidentally

Revoke or rotate it immediately in the provider’s dashboard. Update wp-config.php, remove exposed copies where possible, and review recent API usage.

Frequently Asked Questions

How to Store API Keys Safely in wp-config.php?

Back up the file, define the key as a uniquely named constant above the stop-editing line, and access it only from server-side PHP. Never display or log the real value.

Is It Safe to Place an API Key in wp-config.php?

It is generally safer than theme, plugin, or frontend code, but it is not completely secure. Hosting access, malware, backups, and server errors can still expose it.

Where Should I Add an API Key in wp-config.php?

Add the define() statement above:

/* That's all, stop editing! Happy publishing. */

Can I Access a wp-config.php Constant From a WordPress Plugin?

Yes. After WordPress loads the file, a plugin can check the constant with defined() and read it from server-side PHP.

What Should I Do If My API Key Has Been Exposed?

Revoke or rotate it through the provider, update the stored value, remove exposed copies where possible, and review usage for suspicious activity.

Conclusion

Learning How to Store API Keys Safely in wp-config.php helps reduce accidental exposure and keeps credentials out of replaceable theme or plugin files. Back up the file, define the key above the stop-editing line, retrieve it through a named constant, and never display it in frontend code or logs.

Rotate any key that becomes public. Use environment variables or a managed secret service when your hosting platform supports them, and begin by replacing hardcoded credentials in your current snippets.