keyStatus(); echo '

' . esc_html__('Encryption key for provider keys', 'aiwend') . '

'; if ($k['state'] === 'ready') { $where = match ($k['source']) { 'constants' => __('It comes from wp-config.php (AIWEND_SECRET_KEY), outside the database.', 'aiwend'), 'both' => __('It comes from wp-config.php, with an older key file kept so keys saved earlier stay readable.', 'aiwend'), 'file' => __('It is read from a key file written by an earlier test version of Aiwend, outside the database. Aiwend will not write or move that file. You can switch to a line in wp-config.php whenever you like (see the readme).', 'aiwend'), default => __('It is derived from the secret keys and salts in your wp-config.php, so nothing is stored in the database and nothing has to be set up.', 'aiwend'), }; echo wp_kses('

' . AdminView::badge(__('Ready', 'aiwend'), 'success') . ' ' . esc_html__('Provider keys are encrypted before they are saved and are never shown again.', 'aiwend') . ' ' . esc_html($where) . '

', AdminView::allowedHtml()); if ($k['source'] === 'salts') { echo '

' . esc_html__('If your host or a security plugin ever changes the secret keys and salts in wp-config.php, Aiwend will notice, stop using the changed key, and ask you to enter the provider keys again. To avoid that, set AIWEND_SECRET_KEY in wp-config.php (see the readme).', 'aiwend') . '

'; } echo '
' . esc_html__('Why this key matters, and what to back up', 'aiwend') . '
' . '
' . esc_html__('Why it exists', 'aiwend') . '
' . esc_html__('Your provider API keys give access to a paid account. Aiwend stores them encrypted, and the key that decrypts them is kept apart from the database.', 'aiwend') . '
' . '
' . esc_html__('What it protects', 'aiwend') . '
' . esc_html__('Saved provider keys against a leaked database dump or backup. It does not protect them from someone who can read your site files (a full-site backup or a hacked account), exactly like any key in wp-config.php.', 'aiwend') . '
' . '
' . esc_html__('If it is lost or changed', 'aiwend') . '
' . esc_html__('Saved provider keys cannot be read any more. Nothing else is affected: enter the provider keys again. Keep wp-config.php in your backups together with the database.', 'aiwend') . '
'; echo '
'; return; } if ($k['state'] === 'unusable') { if (($k['problem'] ?? null) === 'salts_changed') { echo '

' . esc_html__('The secret keys and salts in wp-config.php have changed.', 'aiwend') . ' ' . esc_html__('Aiwend derived its encryption key from them, so provider keys saved earlier can no longer be read, and Aiwend will not silently start using a different key. Restore the previous salts if you can. Otherwise add a line AIWEND_SECRET_KEY to wp-config.php (see the readme) and enter the provider keys again.', 'aiwend') . '

'; return; } $why = match ($k['problem'] ?? null) { 'file_mode' => __('Other accounts on this server can read it, and Aiwend could not tighten it (it is not owned by the PHP account). Make the file readable by the PHP account only (mode 600), for example from your hosting file manager.', 'aiwend'), 'file_symlink' => __('The key file is a symbolic link. Aiwend does not follow links for the key. Replace the link with the real file, or point AIWEND_KEY_DIR at the folder that really holds it.', 'aiwend'), 'folder_world_writable', 'folder_group_writable' => __('The folder that holds it can be written to by other accounts on this server, so someone else could swap the key. Make the folder writable by the PHP account only.', 'aiwend'), default => __('It is damaged or unreadable.', 'aiwend'), }; echo '

' . esc_html__('The key file cannot be used.', 'aiwend') . ' ' . esc_html($why) . ' ' . esc_html__('Aiwend will not replace it, because that would make saved provider keys unreadable for good. Restore the key file from a backup, or add AIWEND_SECRET_KEY to wp-config.php.', 'aiwend') . '

'; return; } echo '

' . esc_html__('No encryption key yet.', 'aiwend') . ' ' . esc_html__('Provider keys cannot be saved until there is one. The simulated demo does not need one. Aiwend normally derives the key from the secret keys and salts in wp-config.php, but the ones on this site are missing or still the sample text.', 'aiwend') . '

'; if (is_multisite() && !is_super_admin()) { echo '

' . esc_html__('This is a multisite network: ask a network administrator to add the key.', 'aiwend') . '

'; return; } echo '

' . esc_html__('Fix it in one of two ways, then reload this page:', 'aiwend') . '

    ' . '
  1. ' . esc_html__('Add AIWEND_SECRET_KEY to wp-config.php: a random value of 32 bytes, base64-encoded (see the readme for a one-line command that prints one).', 'aiwend') . '
    2. ' . '
  2. ' . esc_html__('Or put real random values in the eight secret key and salt lines of wp-config.php (the WordPress.org secret-key service generates them).', 'aiwend') . '
'; echo '

' . esc_html__('Aiwend creates no key file. Keep wp-config.php with your backups: without the key, saved provider keys cannot be read after a restore and must be entered again.', 'aiwend') . '

'; } }