Managing WordPress Plugin License Keys: Storage, wp-config.php, Leaks

This article is a localized edition of the Japanese original. Read the Japanese original

Most paid plugins unlock automatic updates and support once you enter the license key issued by the vendor on the plugin's settings screen. WordPress itself has no feature for managing license keys in one place, and where you enter the key and how it is stored differ from plugin to plugin.

This article explains how to find your keys, how to store them, how to set them in wp-config.php, how to handle them when a site is moved, cloned or shut down, and what to do if a key leaks. Building a license inventory and checking why updates do not appear are covered in detail in How to manage licenses for premium WordPress plugins.

What a license key controls

The vendor's server uses the license key to confirm that the site is using a legitimate purchase. In general, the key determines:

• Whether the site receives automatic updates from the admin screen
• Whether you can get support from the vendor
• How many sites you can activate it on (the limit depends on the plan)
• Whether some features are available (depends on the product)

What happens when a license expires depends on the product. For example, ACF PRO's official documentation says that after expiry you can no longer create new PRO fields, while editing existing fields and displaying saved data are not affected. If you keep using a plugin with an expired license, you also stop receiving updates, including security fixes, so it matters to keep track of renewal dates.

1. Identify your paid plugins and their keys

List your paid plugins

In the admin screen, go to "Plugins" → "Installed Plugins" and look at the author name and links in each plugin's description to see who sells it. If you can use WP-CLI, you can export the names, authors and versions as a list.

# Export the plugin list as CSV (raw data for your license inventory)
wp plugin list --fields=name,title,author,status,version,update --format=csv > plugins.csv

Where to look up the keys

If you lose track of a key, first log in to the account you bought it with and check there. If you do not know which account was used, contact the vendor's support with your purchase details (order number, email address and so on).

Where the key lives in the database

Many plugins save the key in the wp_options table. Option names differ by plugin, so searching with WP-CLI for names that contain license gives you a good idea. Show only the names, not the values (the keys themselves).

# Show only the names of options whose name contains license
wp option list --search="*license*" --fields=option_name,autoload

Because the key is in the database, it is also included in database backups and in copies made for a staging environment. This matters for moving and cloning sites, covered later.

2. Store keys safely

• Keep them in a password manager: a password manager, where you can limit who has access, is safer than writing keys in plain text in a spreadsheet or note in a shared folder. Keep the product name, key, purchasing account, plan (number of sites), renewal date and activated sites together in one entry so you do not have to search for them when renewing or moving.
• Buy under a company or organization account: if the purchase is made with a web agency's account or a staff member's personal account, you lose access to the key when the person in charge changes.
• Do not show them to anyone: make sure keys do not appear in support forum posts, screen sharing or screenshots.

3. Set keys with constants in wp-config.php

Some plugins let you set the key by defining a constant in wp-config.php. Because the key then lives in the configuration file rather than the database, this is useful when you set up several environments the same way, or when you want to avoid keys being swapped when a database is copied. The constant names of the three plugins below were confirmed in each vendor's official documentation (as of October 2026).

<?php
// Add these above the require_once ABSPATH . 'wp-settings.php'; line in wp-config.php

// ACF PRO (Advanced Custom Fields PRO)
define( 'ACF_PRO_LICENSE', 'YOUR-LICENSE-KEY' );

// WP Rocket (needs both the key and the email address of the purchasing account)
define( 'WP_ROCKET_KEY', 'YOUR-API-KEY' );
define( 'WP_ROCKET_EMAIL', 'purchase@example.com' );

// Gravity Forms (a constant that fills in the key automatically at installation)
define( 'GF_LICENSE_KEY', 'YOUR-LICENSE-KEY' );

Notes for each product:

• ACF PRO: when the constant is defined, the license is activated with that value. Do not include spaces, and copy every character of the key correctly.
• WP Rocket: the official documentation recommends defining these two constants and then re-validating the license in the WP Rocket screen when license validation fails, for example on a staging environment.
• Gravity Forms: this constant fills in the key automatically if it is defined before installation. On a site where the plugin is already installed, enter the key on the settings screen. On Multisite, it applies to sites added after the constant is defined.

When you use constants, keep wp-config.php out of version control such as Git (or move the key into a separate per-environment file or an environment variable). For file permissions and other wp-config.php settings, see How to configure wp-config.php securely.

For plugins not listed here, check that plugin's official documentation to see whether it supports the same thing. Defining a constant that does not exist simply does nothing and causes no error, so it is easy to miss that it is not working.

4. Moving, cloning and canceling

Licenses are often counted per site URL where they are activated, so how a key behaves changes when the site's URL changes.

How to build a staging environment is explained in How to build a WordPress staging environment and safely push changes to production.

5. If a key leaks

If a third party may know your key, for example because you pushed a file containing it to a public repository or a former employee took it with them, respond in this order:

1. On your account page on the vendor's site, check the list of activated sites and remove any that are not yours
2. Ask the vendor whether the key can be reissued or revoked (this differs by product)
3. When you receive a new key, replace it in each site's settings (or in the wp-config.php constant) and update the entry in your password manager
4. If you pushed it to a public repository, deleting the file is not enough because it stays in the history, so invalidate the key itself

Do not use unofficial copies

"Free" copies of paid plugins distributed outside the vendor may contain malicious code, and without a license they cannot receive official updates. Use only paid plugins bought from the vendor.

Summary

• The license key decides automatic updates, support and how many sites you can activate. What happens on expiry differs by product
• Look up keys on the vendor's account page and store them in a password manager together with the product name, purchasing account, renewal date and activated sites
• ACF PRO (ACF_PRO_LICENSE), WP Rocket (WP_ROCKET_KEY, WP_ROCKET_EMAIL) and Gravity Forms (GF_LICENSE_KEY) can take the key from constants in wp-config.php
• Deactivate the license before moving or canceling, to free up the activation
• If a key leaks, check and remove activated sites and ask the vendor about reissuing the key

Related articles

• How to manage licenses for premium WordPress plugins: from an inventory to migrations and update problems
• How to get support for premium WordPress plugins
• Managing WordPress configuration across local, staging and production

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)