WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture...
Where should I store API keys and application passwords so they are not exposed on my website?
Do not put secret keys in JavaScript sent to the browser, public pages or a Git repository. Visitors can read anything delivered to their browser. Keys explicitly designed for public use are different from those that authorise sensitive operations.
Store application secrets using the method recommended by your application: environment variables or configuration files outside the public directory, where your hosting environment supports this. Restrict file access and check that configuration copies or archives are not publicly accessible.
If a key is accidentally published, revoke it and generate a replacement. Deleting it from a file is not enough if it remains in Git history. Limit each key’s permissions to the operations it actually needs.
