How credentials are protected
All sensitive credentials stored in MLS Genie™ are encrypted at rest using libsodium — the same cryptographic library used by major financial institutions. Credentials are never stored in plaintext in your WordPress database.
The encryption key
Each website has its own encryption key, created by MLS Genie™ and kept in a protected file on the server — separate from the database, so a copy of the database alone cannot be read. It is not tied to the WordPress security keys in wp-config.php, so a security plugin or host that changes those keys leaves your saved settings untouched.
Backup and recovery
A sealed backup copy of each key is held by MLS Genie™. If a server is rebuilt or restored without the key file, the site gets its key back automatically after proving it runs its own domain. Nothing needs to be entered again.
Auto-migration
Credentials saved before this system existed are moved onto the site's own key automatically. If one could no longer be read — for example because the server's security keys were changed first — Connections and the WordPress dashboard name it, and the site owner is emailed, so it can be entered once more.
Best practices
- Enable HSTS in your hosting security settings to prevent credentials from being intercepted in transit.
- Rotate credentials immediately if you suspect they have been compromised.
