---
title: "Choose an Encryption Tier"
slug: choose-an-encryption-tier
type: how-to
plugin: huxx-connect
summary: Select or switch between the Standard, Advanced, and Locked encryption tiers in Settings, with automatic re-encryption of every stored credential.
keywords: [encryption tier, security, settings, wp-config, credentials]
version_added: 1.2.5
version_updated: 1.2.5
level: intermediate
related: [encryption-tiers, environment-lock, configure-environment-lock, store-credentials-outside-the-database]
---

HuxxConnect encrypts stored [credentials](/docs/connect/explanation/glossary/#credentials) on every tier; the tier controls where the encryption key lives. This page covers selecting a tier and switching between them. For what each tier protects against, read [Encryption Tiers Explained](/docs/connect/explanation/encryption-tiers/).

> **Quick version:**
> 1. Go to **HuxxConnect → Settings**, **Security** card, **Encryption Key Source** section.
> 2. The tier tile marked **Active** is your current tier. Click a different tile to open its switch panel.
> 3. **Standard**: click **Switch to Standard**. **Advanced**: click **Generate Keys**, add the two `define()` lines to `wp-config.php`, click **Verify & Activate**. **Locked**: read the warning, click **Switch to Locked**.
> 4. All stored credentials are re-encrypted with the new key automatically — the toast reports how many APIs were re-encrypted.

## Find the tier selector

Go to **HuxxConnect → Settings**. In the **Security** card, the **Encryption Key Source** section shows three tiles:

- **Standard** — "Auto-generated key stored in database. Portable across environments."
- **Advanced** — "Custom key defined in wp-config.php. Most secure option."
- **Locked** — "Site-specific configuration. Not portable during staging or server migrations."

The current tier carries an **Active** badge. Clicking the active tile does nothing; clicking any other tile expands its switch panel below the grid (clicking it again collapses the panel, and **Cancel** does the same).

<!-- screenshot-todo: settings--security--tier-grid | alt: Encryption Key Source section with Standard active and the Advanced and Locked tiles selectable -->

:::novice
Credentials are the secret values (tokens, keys, passwords) an API uses to identify your site. HuxxConnect never stores them as plain text — this setting only decides where the decryption key is kept. See [Understanding authentication](/docs/connect/explanation/understanding-authentication/).
:::

## Switch to Advanced (keys in wp-config.php)

1. Click the **Advanced** tile.
2. Click **Generate Keys**. The panel shows a two-line snippet:

   ```php
   define( 'HUXX_CONNECT_ENCRYPTION_KEY', '...generated 64-character key...' );
   define( 'HUXX_CONNECT_ENCRYPTION_SALT', '...generated 64-character salt...' );
   ```

3. Click **Copy to Clipboard** and add the lines to `wp-config.php` before the `That's all, stop editing!` comment. (**Regenerate** produces a fresh pair if you need one.)
4. Back in Settings, click **Verify & Activate**. HuxxConnect confirms the constants are live, re-encrypts every stored credential with the new key, and moves the **Active** badge to Advanced.

<!-- screenshot-todo: settings--security--advanced-panel | alt: Advanced tier panel showing the generated wp-config constants snippet and the Verify and Activate button -->

Keep a copy of the two constants somewhere safe (a password manager) — they are your migration path. To move this site later, copy them into the destination server's `wp-config.php`; the Settings page repeats this guidance in its **Migration & Portability** section while Advanced is active.

## Switch to Standard (key in the database)

1. Click the **Standard** tile. The panel explains it will switch to auto-generated portable keys stored in the database.
2. Click **Switch to Standard**. Credentials are re-encrypted with a stored key (generated now if none exists).

If you are coming *from* Advanced, the panel notes that you can remove the `HUXX_CONNECT_ENCRYPTION_KEY` and `HUXX_CONNECT_ENCRYPTION_SALT` constants from `wp-config.php` afterward — the stored key is now authoritative, so the constants are inert leftovers.

## Switch to Locked (key from WordPress salts) — read the warning

The Locked panel opens with a downgrade warning, styled as a warning for a reason:

> **Warning:** This locks encryption to this server's WordPress configuration. Credentials cannot be migrated to other servers (staging, host migration, etc).

Switching to Locked derives the key from this install's WordPress salts and **deletes the stored key**. From that point, any migration, clone, or salt rotation makes the existing credentials permanently undecryptable — the recovery is re-entering them by hand. If that trade-off is acceptable, click **Switch to Locked**.

## What re-encryption does

Every tier switch decrypts all API-level credentials and per-endpoint auth overrides with the old key and immediately re-encrypts them with the new key. Nothing is left readable in between, and no request behavior changes. The confirmation toast reports the outcome — "Encryption switched to Advanced. 3 API(s) re-encrypted." — and appends a count of APIs whose credentials could not be converted (per-endpoint auth-override failures do not appear in the toast — they surface via Credential Health). The [Environment Lock](/docs/connect/explanation/environment-lock/) fingerprint is also re-established with the new key, so a tier switch never locks you out of your own site.

## If it didn't work

**"HUXX_CONNECT_ENCRYPTION_KEY constant not detected. Add it to wp-config.php and try again."** — You clicked **Verify & Activate** before the constants were live. Check that both `define()` lines are in `wp-config.php` on this server, above the `That's all, stop editing!` comment, with no typo in the constant names, then click **Verify & Activate** again. On hosts with opcode or config caching, a page reload may be needed first.

**"Already using this encryption tier."** — The switch you requested targets the tier that is already active (this can appear if two browser tabs raced). Reload the page; the **Active** badge shows the real current tier.

**The toast reports failed APIs, or a "Credential Health" table appears.** — One or more credentials could not be decrypted with the old key, so they could not be re-encrypted. The Security card lists each affected API and field under **Credential Health**; open each linked API and re-enter those credentials. The rest of your APIs are unaffected.