Rotate WordPress API Keys & Revoke Backup Access

This guide walks you through rotating WordPress API keys and revoking access for compromised remote backup services. You’ll learn how to identify active keys, generate fresh ones, and cut off any backup connections that may be exposing your site. By the end, your credentials will be renewed and your backups locked down.

What You’ll Need

• WordPress admin access (or a user with manage_options capability)
• FTP/SFTP access or a file manager in your hosting control panel (for editing wp-config.php if needed)
• Access to your remote backup service dashboard (e.g., UpdraftPlus, BackupBuddy, or a custom cron job)
• A list of all plugins that use API keys (e.g., Jetpack, WooCommerce, Mailchimp, or custom integration)

Step-by-Step

1. Identify all API keys currently in use. Go to Plugins → Installed Plugins and note which ones have API key fields in their settings. Common locations: Settings → General, Jetpack → Dashboard, or each plugin’s own settings page. Also check wp-config.php for hardcoded keys (look for lines like define('API_KEY', '...')).
2. List all remote backup connections. Check your backup plugin’s settings for destination URLs, API endpoints, or SSH keys. If you use a custom solution, look in wp-cron.php or your server’s cron table for backup commands that include credentials.
3. Revoke the compromised backup access first. Log into your remote backup service (e.g., Amazon S3, Google Drive, or a backup plugin’s cloud). Delete the existing API key or app password that WordPress uses. If it’s an SSH key, remove it from the server’s authorized_keys file.
4. Generate new API keys for each service. For each service that needs reconnecting, create a new key or token. For example, in Jetpack, go to Jetpack → Dashboard → Connection and click Disconnect, then reconnect with a new key. For WooCommerce, go to WooCommerce → Settings → Advanced → REST API and create a new key with the appropriate permissions.
5. Update WordPress with the new keys. In each plugin’s settings, paste the new key. If the key is in wp-config.php, edit the file via FTP or the hosting file manager, replace the old value, and save.
6. Reconnect your backup service. In your backup plugin, update the destination credentials with the new key. Test the connection (usually a “Test� button) before running a backup.
7. Run a manual backup to verify. Trigger a backup manually. Confirm that it completes successfully and that the file appears on the remote destination.
8. Audit for any other compromised access. Check your WordPress user list (Users → All Users) for suspicious accounts. Review Settings → Security or your security plugin for any active sessions. If you suspect a broader breach, change your admin password and enable two-factor authentication.
9. Revoke old API keys everywhere. Even if you think you’ve replaced them, go back to each service and explicitly delete or revoke the old keys. This prevents any lingering access.

Common Mistakes

• Only rotating the key in WordPress but forgetting to delete the old key on the service side—this leaves the compromised key active.
• Missing hardcoded keys in wp-config.php or theme files. Search the entire theme folder for strings like “api_key� or “secret�.
• Not testing the backup after rotation. A typo in the new key can silently break backups.
• Revoking access before you have the new key ready, causing downtime for your site’s functionality (e.g., payment gateways).
• Assuming only the backup plugin uses API keys—other plugins like analytics or email services may also have keys that need rotation.

Tips

• Use a password manager to store new API keys securely, and never paste them into a shared document.
• Set a calendar reminder to rotate keys every 90 days as a security best practice.
• If your backup service supports it, use a dedicated API key with only write permissions (no read/delete) to limit damage if compromised.
• Keep a local backup of your site before making changes, so you can restore if something goes wrong.
• After rotation, monitor your backup logs for a few days to ensure no errors appear.

Troubleshooting

• Backup fails after rotation. Double-check the new key for extra spaces or line breaks when pasting. Most services allow you to regenerate the key—try that. Also verify that the API endpoint URL hasn’t changed.
• Jetpack won’t reconnect. Clear your site’s cache and try again. If it persists, check your server’s outgoing connection (curl) to the Jetpack endpoint. Sometimes firewalls block the connection.
• Can’t find where a key is defined. Use a plugin like “String Locator� to search the database and files for the key name. Or use your hosting file manager’s search function.
• Site shows error after editing wp-config.php. You likely introduced a syntax error. Open the file and check for missing semicolons or quotes. If the site is completely down, restore the file from a backup.
• Old key still works. Some services cache keys for a short time. Wait 5–10 minutes and test again. If it still works, you may have missed a second location where the key is stored (e.g., in a database option).

Frequently Asked Questions

How often should I rotate WordPress API keys?

Every 90 days is a good baseline, but rotate immediately after any suspected compromise or after an employee with access leaves.

What if I don’t know which backup service is compromised?

Rotate all API keys that have access to your site, and revoke all remote backup connections. Then re-add them one by one, testing each.

Can I revoke backup access without affecting my site’s functionality?

Yes, as long as the backup service is only used for backups. If it’s also used for other features (like a CDN or media storage), you’ll need to reconnect with a new key quickly.

Do I need to change my WordPress admin password too?

If the compromise involved a user account, yes. Even if not, it’s a good precaution.

What if my backup plugin uses a username/password instead of an API key?

Rotate that password just like you would an API key. Most services allow you to create an app-specific password.

Is it safe to store API keys in wp-config.php?

It’s safer than in the database, but not ideal. Use environment variables if your host supports them, or a secrets manager.

Related

• Squadron 42 VR Compatibility & Setup Explained
• VS Code Extension Conflicts: How to Troubleshoot
• Forge Captain Rowan Quest Guide