Diagnose Sodium cryptographic errors in WordPress

WordPress and some plugins use cryptographic functions to verify signatures and protect data. PHP can provide them through the native Sodium extension, and WordPress also includes a compatibility library for environments that do not have it.

A log may show an error like this:

PHP Fatal error: Uncaught TypeError: Argument 2 must be a string, integer given. 
in /home/usuario/public_html/wp-includes/sodium_compat/src/Core/Util.php:242

This TypeError confirms that the second argument received was an integer when the function required a string. The trace passing through wp-includes/sodium_compat/ does not prove that Sodium is missing, nor that enabling the extension would convert that value correctly.

1. Keep the full stack trace

Note the time and look in the trace for the first file outside wp-includes/sodium_compat/. It usually lets you identify the plugin, theme or integration that prepared the arguments. Do not change the files in wp-includes: they are replaced on update and do not fix the caller.

2. Check the website's PHP environment

Check in the PHP information whether the sodium extension is loaded. Do the check from the same PHP that runs the website: PHP CLI may use a different version or configuration.

• If the plugin explicitly requires the native extension and it is not loaded, enable it from Select PHP Version or ask your provider to do so.
• If Sodium is already active, or the error points to an invalid type, update the identified component and check with its developer why it sends an integer.
• If the failure appeared after changing PHP, confirm that the website keeps the same extensions in the new version.

3. Verify the fix

Repeat exactly the operation that was failing and check the log for the same time. Confirm that the TypeError no longer appears and that the signature, webhook or integration involved completes its process. The extension being present does not by itself verify that the data sent is valid.

Do not convert the argument to a string inside sodium_compat to avoid the TypeError: keys, signatures and messages have specific formats and lengths. A conversion that removes the error may leave an incorrect verification.

When sharing the trace with the developer, keep function names and types, but leave out keys, private signatures, tokens and sensitive content. Use test data to reproduce the cryptographic operation; a screen without an error is not enough if validation has been skipped.