Skip to content

Latest commit

 

History

History
193 lines (129 loc) · 8.28 KB

README.md

File metadata and controls

193 lines (129 loc) · 8.28 KB
Raw

GFE Preset

Packagist Version PHP from Packagist Packagist Downloads GitHub License Hire Itineris

Goal

By default Gravity Forms Encrypted Fields generate website key automatically on web servers which violates 12-factor principle and makes backing up difficult.

GFE Preset overrides the website key via PHP constants so that the key always in a known state.

Moreover, encrypting with unknown encryption keys means you can't decrypt if disasters happen. Better safe than worry. GFE Preset triggers wp_die if required constants not defined.

Besides, GFE Preset provides similar overrides to:

  • CodeCanyon license key
  • encryption key (also known as encryption password)

Minimum Requirements

Installation

$ composer require itinerisltd/gfe-preset

Usage

Normal WordPress

Define these 3 constants in wp-config.php:

// Required:
define('GFE_PRESET_WEBSITE_KEY', 'aaa');
define('GFE_PRESET_ENCRYPTION_KEY', 'bbb'); // Also kown as **encryption password**

// Optional:
define('GFE_PRESET_LICENSE_KEY', 'zzz');

Bedrock

Define these 3 constants in config/application.php:

// Required:
Config::define('GFE_PRESET_WEBSITE_KEY', 'aaa');
Config::define('GFE_PRESET_ENCRYPTION_KEY', 'bbb'); // Also kown as **encryption password**

// Optional:
Config::define('GFE_PRESET_LICENSE_KEY', 'zzz');

Warnings

  • You must save Gravity Forms Encrypted Fields setting page whenever:

    • installing/activating the plugins
    • updating the plugins
    • changing the constants

  • You should run "ENCRYPTION TESTING AND VERIFICATION" on the plugin settings page

  • You should backup all the constants

  • You should backup website key and encryption password shown on the plugin settings page

    • Without both website key and encryption password, you can't decrypt the data

  • You should practice backing up and restoring the whole WordPress installation from time to time

  • Normal Gravity Forms Security Best Practices still applies

  • Gravity Forms Encrypted Fields backup, verification, usage procedures still apply

    • You must read the plugin readme and notices on the plugin setting page in full, and follow the instructions

FAQ

Why GFE_PRESET_WEBSITE_KEY and GFE_PRESET_ENCRYPTION_KEY must be defined?

This is to prevent encrypting with unknown (not backed up) website key and encryption key, which end up with a unrestorable database (data is encrtpyed but you can't decrypt them).

Should I reuse GFE_PRESET_WEBSITE_KEY and GFE_PRESET_ENCRYPTION_KEY?

No!

Each WordPress installation (enviroment) should have its own set of GFE_PRESET_WEBSITE_KEY and GFE_PRESET_ENCRYPTION_KEY, i.e: staging and production servers should use different keys.

I have installed this plugin. Does it mean my WordPress site is unhackable?

No website is unhackable.

To have a secure WordPress site, you have to keep all these up-to-date:

  • WordPress core
  • PHP
  • this plugin
  • all other WordPress themes and plugins
  • everything on the server
  • other security practices
  • your mindset

Will you add support for older PHP versions?

Never! This plugin will only works on actively supported PHP versions.

Don't use it on end of life or security fixes only PHP versions.

It looks awesome. Where can I find some more goodies like this?

This isn't on wp.org. Where can I give a ⭐️⭐️⭐️⭐️⭐️ review?

Thanks! Glad you like it. It's important to let my boss knows somebody is using this project. Instead of giving reviews on wp.org, consider:

Testing

# Code style checks.
$ composer style:check

Pull requests without tests will not be accepted!

Feedback

Please provide feedback! We want to make this library useful in as many projects as possible. Please submit an issue and point out what you do and don't like, or fork the project and make suggestions. No issue is too small.

Change Log

Please see CHANGELOG for more information on what has changed recently.

Security

If you discover any security related issues, please email [email protected] instead of using the issue tracker.

Credits

GFE Preset is a Itineris Limited project created by Tang Rufus.

Full list of contributors can be found here.

License

GFE Preset is licensed under the MIT License. Please see License File for more information.