Encryption of WordPress Posts

As far as I know what you ask is not really possible with WordPress (or any plain PHP app) alone. It is same dilemma as with database credentials in WP – if FTP is hacked then hacker gets database login/password from wp-config.php. It is impossible to protect those because WordPress (or any other PHP app really) needs them for database access. Even if they are stored encrypted at some point they will need to be decrypted.

Same thing with posts – even if store encrypted posts in database at some point WordPress will need to decrypt them. If WordPress can decrypt them then so does person who hacked account.

You can probably somehow separate keys from WordPress installation, but that is simply moving issue around – now still have to think about protecting keys from being hacked/leaked, they are just in another place.

Leave a Comment