Plugins created by me, in which personal or confidential data is entered, always contain a method to store this data in a secure manner. Let me briefly describe this in more detail.

An extremely important and justified question! Plugins created by me, in which personal or confidential data is entered, always contain a method for securely storing this data in encrypted form. Let me briefly describe this in more detail. Preliminary remark This is not about creating backups. The topic of this article is a description of how plugins developed by me handle data worthy of protection. As the website operator, you are responsible for backing up your website's data. Basic ideas There are various methods of implementing encryption. The German Federal Ministry for Security has provided an article on this here: https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Daten-sichern-verschluesseln-und-loeschen/Datenverschluesselung/datenverschluesselung_node.html They recommend the use of the Advanced Encryption Standard (AES), which according to current knowledge is the way to go. However, this alone is not enough, as you should not only think about the encryption method but also about where the necessary key is stored. Use in my plugins Each of my plugins that require this therefore contains a component that provides AES encryption based on PHP's own functions. In hosting where OpenSSL is available, this is also used. If OpenSSL is not available, Sodium is used. The encrypted data is stored in WordPress' own database. Keys are required for both methods. These are neither stored in the files of my plugins nor in the project's database, but in the project's wp-config.php. If the wp-config.php cannot be written to, a must-use plugin is created that contains the key. This means that the encrypted data and the key for decryption are logically separated. According to my research, this corresponds to the ISO/IEC 27002 standard. Advantages of this method Unlike other solutions, the user of the plugin does not have to worry about this protection. My plugins do this fully automatically in the background. This means that there is literally no effort required to set it up. Disadvantages Of course, there are also disadvantages. If the key is lost, the encrypted data can no longer be decrypted. The website operator should therefore make sure to include the wp-config.php and/or the must-use plugin in his data backup. This is the only way to restore the key used and access your data in the event of unexpected problems with one of the files. Interested? The code for the above is included as a GPL license in the respective free plugins. An example can be found here: https://github.com/threadi/wp-personio-integration-light/blob/master/app/Plugin/Crypt.php If you have any questions, please contact me :-)

Topic: Frequently Asked Questions

Articles

How is the data I enter backed up?
Plugins created by me, in which personal or confidential data is entered, always contain a method to store this data in a secure manner. Let me briefly describe this in more detail. Read more
Easy Language – Simple and Easy Language, External files in the media library, Personio Integration Light, ProvenExpert
Why can't I unpack a ZIP?
The „External files in the media library“ plugin makes it possible to unpack ZIP files in the media library. The requirements for this are described here. Read more
External files in the media library
How can I submit a support request?
If you have any questions about the commercial WordPress plugin Personio Integration, you are welcome to use the support request form, which is included in the plugin. Read more
Personio integration
The import of jobs is already underway - why?
This message can be displayed by the „Personio Integration Light“ plugin under the following conditions. Read more
Personio integration, Personio Integration Light
Can I embed PDF files stored on AWS S3 without their URL being public?
Yes, this is possible under the following conditions: Once this is fulfilled, every file hosted on AWS S3 would be recognized as an external file and delivered via the proxy. The URL behind the proxy is not publicly visible. Read more
External files in the media library
I don't see any updates for the plugins?
Normally, pending updates should be visible in the backend under „Updates“ or in the list of plugins. If this does not happen, there may be various reasons. Check website status Check under Tools > Website status to see if there are any messages from WordPress itself about external connections. WordPress recognizes possible problems when retrieving updates itself and Read more
Personio integration, Personio Integration Light
How can I import files from a public Google Drive?
It is entirely possible to import files available in a public Google Drive into your media library as external files. However, there are a few things to keep in mind when doing so. Read more
External files in the media library
I want to upload .tar.gz files—how do I do that?
Files with the extensions .gz and .tar.gz are not permitted by WordPress itself. This is primarily for security reasons, as these files are unfortunately often used for attacks or to infiltrate malware. With the plugin „External Files for the Media Library,“ you can still upload them to WordPress—as described here. Read more
External files in the media library
How was the plugin created?
The plugin „Next Meetup Note“ was created as part of a presentation on plugin development at the WordPress Meetup in Leipzig on October 1, 2024. Read more
Next Meetup Notice
Can I restrict other users from storing external files?
Yes, the External Files plugin in the media library comes with a wealth of permissions. Here you can find a description of what is possible. Read more
External files in the media library