The Member Directory and Profile Pages Add On uses a single Google Maps API key for two different jobs: rendering the interactive member map in the browser with the Google Maps JavaScript API, and converting member addresses into map coordinates with the Google Geocoding API. Both calls read that same key from Memberships > Settings > Advanced.

That single key forces a tradeoff. Restrict it by HTTP referrer, the way Google recommends for any key exposed in browser JavaScript, and your server-side Geocoding API calls stop working, since Google cannot validate a referrer on a request that never came from a browser. Leave it unrestricted so geocoding keeps working, and you have a public API key anyone can find in your page source and use on their own projects at your expense.

This code recipe shows you how to use the pmpromd_maps_geocoding_api_key filter to give geocoding its own private key. With two keys, you can restrict each one properly: the public key by HTTP referrer, the geocoding key by server IP address, exactly as Google’s documentation recommends.

This recipe is worth adding if any of the following apply to your site:

• Your Google Maps API key is unrestricted (no HTTP referrer restriction), which means anyone who views your page source can copy it and use it on their own site, and Google bills the usage to your account.
• You tried restricting the key by HTTP referrer, and your member map’s geocoding stopped working, since referrer restrictions block server-side requests.
• A security review flagged that your single Maps API key is exposed in public JavaScript with no restrictions.

If your Maps API key is already restricted and your map still works, or you are not concerned about the key being public, this recipe is optional.

Google Cloud lets you restrict an API key in one of two ways: by HTTP referrer (for keys used in browser JavaScript) or by IP address (for keys used in server-side calls). You cannot apply both restriction types to the same key. That is the core reason to split the key:

• Keep your existing key restricted by HTTP referrer for the JavaScript Maps API, since that call always originates from a visitor’s browser.
• Create a second key restricted by your server’s IP address, and enable it only for the Geocoding API. Use that key with this filter.

Enable the Geocoding API on the new key. When you create the second key in Google Cloud Console, restrict it to the Geocoding API specifically. A key with no API restrictions works, but it defeats the purpose of separating them.

The pmpromd_maps_geocoding_api_key filter runs right before the Member Directory and Profile Pages Add On sends a geocoding request to Google. Internally, the Add On calls apply_filters( 'pmpromd_maps_geocoding_api_key', $map_api_key ), passing in the key currently configured on the Advanced settings page. Your callback receives that value and returns the key you want used instead.

Returning a different string here overrides the key for geocoding calls only. Your Advanced settings page key still handles the front-end JavaScript map, untouched.

1. In the Google Cloud Console, create a new API key and restrict it to the Geocoding API.
2. Under Application restrictions, choose IP addresses and add your web server’s outbound IP address (your host can provide it if you don’t know it).
3. Add the snippet below to a Code Snippets plugin or a site-specific plugin, replacing NEW_KEY_HERE with your new key.
4. Trigger a geocoding event, such as a member updating their address, and confirm the member’s location still appears correctly on the map.

When you are done, your Credentials page should show two separate API keys, each with its own restriction type.

You can add this recipe to your site by creating a custom plugin or using the Code Snippets plugin available for free in the WordPress repository. Read this companion article for step-by-step directions on either method.

• Insert your key (line 19): Replace NEW_KEY_HERE with your restricted geocoding API key.
• To pull the key from an environment variable or wp-config.php constant instead of hardcoding it in the snippet, swap the assignment for something like $key = defined( 'PMPRO_GEOCODING_API_KEY' ) ? PMPRO_GEOCODING_API_KEY : $key;.