Encrypted credentials google business profile plugins should be the default. Plugins that store OAuth client secrets in plain text put your business and your customers at risk. This guide explains what to expect from a properly built plugin in 2026.
Why credentials must be encrypted
OAuth secrets give full access to your Google Business Profile. A leaked secret can be used to post on your behalf, read your reviews, and pollute your insights. Plain text storage in the options table is the most common attack surface.
Encryption at rest blocks the database dump attack vector.
How proper encryption works
GMB Poster uses AES-256-CBC encryption keyed off your site AUTH_KEY constant. The encryption key never appears in the database. Credentials are encrypted before write and decrypted only when needed for the Google API call.
the GMB Poster plugin also never logs credentials and never returns them in REST API responses.
How to verify your plugin
Look at the options table directly. Search for your OAuth client secret. If you find it in plain text, the plugin is unsafe. If you find encrypted bytes, the plugin is doing it right.
Check the REST API responses for any field that should be private. If the secret appears in a response, that is a leak.
Rotation policy
Rotate OAuth secrets when staff leave, when credentials are suspected compromised, or annually as a hygiene practice. Encrypted storage makes rotation trivial because the plugin handles the re encryption automatically.
Document who has access to credential rotation as part of your incident response plan.
Beyond the secret
Access tokens and refresh tokens are equally sensitive and need the same encryption treatment. Some plugins encrypt the client secret but leave tokens in plain text. That is still a leak.
Verify the full credential lifecycle is protected.
Frequently asked questions
Are encrypted credentials google business profile plugins now standard?
For new plugins yes. Older plugins are inconsistent. Audit your plugin before trusting it with production credentials.
What if my AUTH_KEY changes?
You will need to re enter credentials. The plugin cannot decrypt the old store with a new key.
Is the AUTH_KEY a single point of failure?
It is part of WordPress core security. Treat it like any other secret. Rotate carefully.
Does this slow down posting?
No. Decryption is microseconds per call.
Related reading
- Per install OAuth credentials
- OAuth setup walkthrough
- GMB Poster on WordPress.org – the plugin powering these workflows.
