Actually, there’s not too much you can do.
If an intruder has direct access to your site – where they can run get_option() or perform direct SQL queries – then you’ve already run into a problem. The safest bet here is to exercise your best judgement when installing new plugins.
In other words, the best plan of action is prevention. Don’t install plugins you don’t recognize or written by developers you don’t trust.
While you could use encryption to protect the data, remember that WordPress itself still needs access. So if WP can read the data, then anyone who can run get_option() can also read the data.
Related Posts:
- Validating values using Settings API?
- What are the common security flaws I need to look for? [closed]
- WordPress Capabilities: edit_user vs edit_users
- How to find out if option exists but is empty?
- Custom plugin settings: clicking “save changes” does not display success message
- Where should my plugin POST to?
- Security error WP 4.0 + WP phpBB Bridge [closed]
- How to fetch serialized data from wordpress options
- Should I use RIPS tool to test my themes and plugins?
- Get all options saved by another plugin
- add action wp_head not working
- Why is the Settings API is not saving my array of options
- Escape when echoed
- Default Plugin Settings Not Writing to Database
- Update Option Error: Notice: Undefined index
- Serialize data for wp options
- How can I add an options page for my class based plugin?
- Get plugin option in another PHP file
- wp_create_nonce function doesn’t work inside a plugin?
- How to get specific setting by settings_fields()?
- Add Plugin options as subpage to Theme options page
- php page not found for plugin options menu
- add tabs in rdp-plugin/includes/settings.php and get settings saved
- Redirect to another page using contact form 7? [closed]
- I should enable automatic updates?
- Prevent direct access to WordPress plugin assets?
- WordPress error: Options page Setting_ not found in the allowed options list
- Can I use register_settings and unregister_setting once the settings page has loaded?
- update_option_{$option} not showing old value
- get_option / wp_localize_script Not Working in OOP Plug In
- Need to add/remove group of options and display them as rows
- How to get values from network settings panel?
- How to make sure settings are not lost when plugin is updated?
- wp_options not returning value for logged out users?
- How to save Setting pages data to the database?
- Security of a WordPress Plugin
- Help to Create a Simple Plugin to make a post
- Content-Security-Policy implementation with WordPress W3Total Cache plugin installed
- Problem with MEMCACHE and Redis with wp_options
- Securing a plugin pop-up window
- Plugin Options Page and Subpage
- How to save the option’s new values plus old value without overwrite old one
- WP options plugin setting not saving the selected checkboxes
- Echo custom admin field into a is_single()
- Protect WordPress option value
- WordPress Boilerplate Plugin doesn’t see callback functions for add_settings_field and add_settings_section
- How do I add a textarea (multirow) option to my WordPress plugin?
- Why is the WordPress update_option not working in this code?
- wp_verify_nonce fails always
- How to create a new database table whenever user changes options
- Create Array from data in the OPTIONS table
- Saving an array to get_options
- Building a simple “settings” plugin to change textstrings on the home page
- My first plugin doesn’t save the data in options
- How to access values from your own settings page in javascript?
- move setting data from wordpress api to codestar freamwork
- When to store store plugin options as a single database record?
- WordPress.Security.NonceVerification.Recommended
- Secure way to add JS Script to WordPress filesystem
- How to save post change url youtube link?
- Best approach to fetch data from wp options to js file or php file
- Correct way to perform non-cacheable DB query
- Allow users of my plugin to define their own shortcode rather than use mine?
- Is it possible to create Custom Post plug-in?
- uninstall.php file in Plugin to clean DB
- Archive – same title for the first two posts
- Creating a plugin to sanitize comment and the url field before display only
- Edit Yoast SEO breadcrumbs output [closed]
- Creating plugin using simple_html_dom parser?
- Object Oriented Plugin not working
- Does WP identify plugin by plugin name or plugin_basename?
- switched from query_posts to WP_query, not working now?
- Making a plugin only available on the front-end for the logged in super admin
- Create entire wordpress as a github repositery?
- Help With MySQL to WPDB Query Conversion
- When to load auto-login code?
- AJAX search posts and pages
- How to find the origin of a file upload from within wp_handle_upload?
- How would I go about creating a user ranked post popularity page?
- CSV file generation failing
- Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)
- Updating the Drag-To-Share eXtended share URLs?
- Admin Theme customization
- finding whether request is for post, and post id
- Building plugin with changeable custom post type values…advice needed
- How to get all of the activate_plugin action parameters?
- __callStatic method handler passed to add_action causes bug in PHP
- Upgraded to latest version – 3.0.3 and Now I get a “sufficient permissions to access this page” error
- Enqueue WordPress plugin scripts below all other JS
- Display update notification messages like ‘What’s New’
- How to add Internationalization in WordPress using Javascript/React?
- CRUD and Frontend show from a custom table without shortcode
- Save / Show multi line text in metabox
- Creating mySQL procedure with $wpdb
- how to disable blockrenderAppender inside all Innerblocks?
- why doesn’t this update part of this plugin work? it take me to nothing here page
- Redirection of users away from wp-admin (but not administrators)
- Headers Content-Security-Policy CSP Major Issue
- WordPress Gutenberg react make import of __experimentalUseInnerBlocksProps which is no more experimetal
- Using a custom plugin to capture input data via Ajax and PHP