WordPress is a great platform but for storing sensitive information it is not the most secure platform.
In some circumstances you may want to ask your customers for sensitive information (such as usernames & passwords) and this data is probably best not stored in your WordPress database.
If a hacker gains access to your site via a theme / plugin exploit then they will have access to your database and be able to view all your data.
For that reason we added secure fields to the FAST ticket plugin. These fields are not stored in the WordPress DB but are instead sent to a WordPress hook where you can send this data to be stored elsewhere.
In this example we will show you how to set up a simple API that receives this data and stores it in a MySQL database. Your agents can then log into this more secure site to access the data if they need it.
We will now walk you through how Secure fields on tickets works.
fast_filter_save_secure_fields
filter with secure field valuesfast_filter_save_secure_fields
filter and makes a POST request to secure APIInside the fast-secure-fields-example.zip you will find the followin files and folders
Folder / File | Description |
---|---|
docs/ | The docs your are looking at now |
fast-secure-fields-example-plugin.zip | Secure fields plugin that adds a hook that will send ticket secure fields to the API |
secure-api.zip | The PHP API used to store secure data |
You will need a PHP MySQL enabled server, we would recommend Digital Ocean for this.
Useful links
You will need to set up Apache or NGINX, PHP and MySQL on your new webserver.
Once you have your server up and running log in and create a database, this is easier if you have a GUI like PHPMyAdmin but it can also be done easily from the command line.
Create Database
mysql -u username -p
*enter password*
create database secure;
Create Database Tables
Then there is a handy sql dump file in the zip called database.sql you can use this to create the 2 tables the API needs with this command.
mysql -u username -p secure < database.sql
Add a user to the database
Create a SHA512 of the users password here.
Login to mysql and insert the user
mysql -u username -p secure
INSERT INTO `users` (`id`, `username`, `password`, `login_count`) VALUES (NULL, 'morris', 'd404559f602eab6fd602ac7680dacbfaadd13630335e951f097af3900e9de176b6db28512f2e000b9d04fba5133e8b1c6e8df59db3a8ab9d60be4b97cc9e81db', '0')
Here is how you can set up the PHP API and agent access page.
Upload PHP files
Upload the contents of the secure-api.zip file into your web server root (/var/www on Ubuntu)
Install dependencies
Type the following command from the root of your secure-api installation folder:
composer install
You will need to have Composer installed on your machine.
Configure Fields
Edit config.php file to make sure the API can connect to your new database.
define('FAST_SECURE_DATABASE_TYPE', 'mysql');
define('FAST_SECURE_DATABASE_NAME', 'secure-api');
define('FAST_SECURE_DATABASE_SERVER', '127.0.0.1');
define('FAST_SECURE_DATABASE_USERNAME', 'root');
define('FAST_SECURE_DATABASE_PASSWORD', 'root');
define('FAST_SECURE_MAX_LOGIN_ATTEMPTS', 3);
define('FAST_SECURE_ENCRYPTION', 'sha512');
define('FAST_SECURE_TOKEN', 'wUSEfkjcXNuJT82kcyuQ7x53qLcTnPV5QvK3Kfzp5Yu4ZwxrLAKc9PQn3aX7E8kGqBfJjF4YwMx67yUPytJLmZbnCtBE7KJNGVaECs3JvgEgWJf8zgaXDHgdjkLJxZ');
You should only need to change the database name user and password to match the DB you set up in the previous step.
Once the site is up and running you should see a site that looks like this at the root
API web server setup
You should also configure your Apache / NGinx server to point to the /api/index.php file.
See slim guide for instructions on how to configure the API.
Once you have the API set up you should be able to POST to it using the following endpoint.
mysite.com/api/fields
You will need to include the following Authentication header
Authorization: Bearer wUSEfkjcXNuJT82kcyuQ7x53qLcTnPV5QvK3Kfzp5Yu4ZwxrLAKc9PQn3aX7E8kGqBfJjF4YwMx67yUPytJLmZbnCtBE7KJNGVaECs3JvgEgWJf8zgaXDHgdjkLJxZ
The bearer token will need to match with the FAST_SECURE_TOKEN define in the config.php file.
This is already done for you by the Fast Secure Fields Plugin which is also included and instructions are detailed below.
You will need to install the plugin fast-secure-fields-example-plugin.zip
Click Add New
At the top of the page you will see an Upload Plugin button, click that
Next click Choose file button in the box that appears below
Select the fast-secure-fields-example-plugin.zip file you downloaded from CodeCanyon
When the zip file has finished uploading click the Activate Plugin button
There are only 2 settings you need to configure in the plugin.
After that all this plugin does is takes the secure fields data from your plugin and passes it on to your API.
Create some secure fields to store in your API.
After that your secure fields should show up when new users create a ticket.