How credentials are protected
All sensitive credentials stored in MLS Genie™ are encrypted at rest using libsodium — the same cryptographic library used by major financial institutions. Credentials are never stored in plaintext in your WordPress database.
The encryption key
The encryption key is derived from your WordPress security keys (defined in wp-config.php). This means the encrypted values are tied to your specific WordPress installation — they cannot be decrypted if the database is moved to a different site without the same keys.
Auto-migration
If credentials were entered before the encryption system was active, MLS Genie™ automatically encrypts them on the next load. No manual action is required.
Best practices
- Never share your wp-config.php file — it contains the keys used to derive the encryption key.
- Enable HSTS in your hosting security settings to prevent credentials from being intercepted in transit.
- Rotate credentials immediately if you suspect they have been compromised.