Secure ACH Vault for WordPress

A portfolio-grade WordPress plugin demonstrating secure ACH intake, encrypted storage, one-time access links, role-based reporting, and scheduled reminder workflows.

Overview

This project demonstrates how sensitive banking information can be collected in a WordPress environment without exposing raw account details in email, spreadsheets, or everyday internal workflows.

The plugin provides a secure intake form for ACH details, encrypts sensitive values before storage, and allows controlled retrieval through short-lived one-time links. It also includes role-restricted reporting access, webhook notifications, and a reminder/escalation workflow for incomplete submissions.

What this project demonstrates

• Secure form handling in WordPress
• Encryption of sensitive data at rest
• One-time expiring access links
• Role-based access control for sensitive reporting views
• Scheduled reminder and escalation workflows with WP-Cron
• Webhook integration for downstream automation
• Lightweight front-end UX with plain JavaScript and CSS

Core features

1. ACH intake form

• Shortcode-based front-end form
• Nonce validation
• Honeypot spam protection
• Optional Cloudflare Turnstile support
• Routing number checksum validation
• Account number confirmation flow

2. Sensitive data protection

• Routing and account values are encrypted before database storage
• Support for AES-256-GCM when available
• Fallback to AES-256-CBC with HMAC-SHA256 authentication
• Masked account metadata stored separately for reporting convenience
• Record wiping and retention cleanup support

3. Controlled access

• Reporting view restricted by role or capability
• One-time access links generated on demand
• Access links expire automatically
• Access links are invalidated after first successful use

4. Workflow automation

• Webhook notification on submission
• Webhook notification on link generation
• Reminder scheduling for incomplete requests
• Escalation webhook trigger when deadlines are reached

Shortcodes

ACH form

[sav_ach_form]

ACH report

[sav_ach_report]

Configuration

This plugin is designed so environment-specific values can be defined outside the plugin code.

Example wp-config.php constants:

define('SAV_ACH_VAULT_SECRET_KEY', 'replace-with-a-long-random-secret');
define('SAV_ACH_VAULT_ZAPIER_WEBHOOK_URL', 'https://hooks.zapier.com/hooks/catch/your-hook-here/');
define('SAV_ACH_VAULT_REPORT_URL', 'https://example.com/ach-report/');
define('SAV_ACH_VAULT_LINK_TTL_DAYS', 14);
define('SAV_ACH_VAULT_RETENTION_DAYS', 90);
define('SAV_ACH_VAULT_ESCALATION_WEBHOOK_URL', 'https://hooks.zapier.com/hooks/catch/your-escalation-hook/');

Optional Cloudflare Turnstile support:

define('SAV_ACH_VAULT_TURNSTILE_SITE_KEY', 'your-site-key');
define('SAV_ACH_VAULT_TURNSTILE_SECRET_KEY', 'your-secret-key');

Architecture notes

The plugin is organized into:

• a bootstrap file
• the main ACH vault class
• a reminder and escalation class
• lightweight CSS and JavaScript assets

Some integration-specific identifiers are intentionally preserved for compatibility with surrounding systems, but the public-facing plugin naming and structure have been neutralized for portfolio use.

Security notes

This project is intended as a practical secure workflow example for WordPress environments. It is not presented as a PCI-certified or NACHA-certified financial platform.

Production use should include:

• environment-specific secret management
• transport security
• access-control review
• infrastructure hardening
• logging and audit review
• security review appropriate to the organization

License

GPLv2 or later