How PressBot Protects Your AI Keys

PressBot runs on your own AI keys. You paste an Anthropic, Gemini, OpenAI or DeepSeek key, and your site talks to the AI directly, with no middleman billing you per message. That model only works if your key stays yours. In October, users of another AI tool reported their provider keys being used to run up charges, and it made us look hard at how we handle yours. Here’s what we changed in PressBot 1.20.11, what it protects against, what no plugin can protect against, and five things worth doing with any AI key today.

How keys actually leak

When people picture a stolen key, they picture someone breaking encryption. That’s almost never how it happens. Keys leak because an application hands them out: a settings screen that sends the key to the browser, a debug field left in an API response, an error message that repeats the request it failed on, a log file that ends up somewhere public. Or because a database backup or staging copy ends up where it shouldn’t.

So we asked two questions. If someone gets a copy of your database, can they use your keys? And is there any way out of PressBot, on any screen, response, message or log, where a key could come back out?

What we built

All of this is in the free plugin, and it’s automatic: existing keys upgrade the first time 1.20.11 loads.

• A vault with modern encryption. Your AI keys, Telegram bot token and Google credentials are now stored with authenticated encryption (XChaCha20-Poly1305, from the libsodium library built into PHP and WordPress). Unlike older methods, it doesn’t just hide the data. It also detects if anyone has changed it.
• A database copy is not enough. The encryption key comes from your site’s wp-config.php security keys, never from the database. Database backups and leaks usually don’t include that file, so a stolen copy of the database gives an attacker scrambled data and nothing to unscramble it with.
• Every key gets its own lock. Each secret is encrypted with its own derived key and tied to its own field and to your site. An encrypted key can’t be copied into a different field, or onto a different site, and still work.
• Keys never come back out. After you save a key, PressBot shows only its first and last few characters. Everything PressBot sends out (admin screens, AI apps connected over MCP, Telegram messages, error messages and logs) passes through a filter that removes PressBot’s own keys, and anything that looks like a key is hidden from errors and logs.
• Tested on every release. Our automated tests plant a fake key with a unique marker, then go through PressBot’s screens, responses and logs looking for it. If the marker shows up anywhere, the release is blocked. That makes “a key leaks through an endpoint” a bug that fails our build, not one a customer finds.
• Keep keys out of the database entirely. If your host lets you edit wp-config.php or set environment variables, you can put a key there (for example PRESSBOT_ANTHROPIC_API_KEY). Connections then shows “Set in your server configuration”, and the key never touches the database.
• Pro: Telegram can’t be faked from a database leak. The secret that proves a message really came from Telegram is now stored only as a one-way hash. Someone holding a copy of your database can’t use it to send your agent fake commands.
• Clear messages when something changes. If your WordPress security keys are ever changed (a normal step after cleaning up a hack), PressBot now tells you plainly to paste your keys again, instead of failing with confusing provider errors.

What no plugin can protect against

We’d rather say this plainly: if an attacker can run their own code on your server, through a malicious plugin or a breach at your host, they can read your keys. PressBot has to be able to read a key to use it, and so does anything else running with the same access. That’s true of every WordPress plugin that stores an API key, whatever it claims.

The same goes for a key stolen somewhere other than your site: from a laptop, a leaked .env file or another tool you’ve pasted it into. PressBot can’t see that happen. What protects you there are the limits you set at the AI provider, which is why the next section matters more than any encryption.

Five things to do with any AI key today

These work whether or not you use PressBot:

1. Set a spending limit at the provider. Anthropic, OpenAI and Google all let you cap monthly spend. A stolen key with a small cap is a small problem.
2. Use one key per site or tool. If a key leaks, you’ll know where from, and you can replace it without breaking everything else.
3. Restrict keys where the provider allows it. Google lets you limit a Gemini key to one API and to your server’s IP address, so a copy doesn’t work anywhere else.
4. Watch your provider’s usage page now and then. If the bill is noticeably higher than what your tools report, replace the key.
5. Replace a key the moment you suspect it. Create a new one, paste it into your tools, then delete the old one at the provider. Deleting it there is what actually stops a thief.

What’s next

The vault is the first layer. Next we’re working on making a stolen key cheaper and louder: a per-provider checklist for those limits in Connections, alerts when a key is added or replaced, and a quick way to lock everything down if you think a key leaked.

If you run PressBot, update to 1.20.11; there’s nothing else to do. If you don’t, the free plugin is on WordPress.org as GreenScript PressBot, and our changelog lists every release.