diff --git a/.gitignore b/.gitignore
index 582f2a5dd9..80c76ee1e4 100755
--- a/.gitignore
+++ b/.gitignore
@@ -146,6 +146,9 @@ Marlin/*/*/readme.txt
 Marlin/*/*/*/readme.txt
 Marlin/*/*/*/*/readme.txt
 
+# Secure Credentials
+Configuration_Secure.h
+
 #Visual Studio
 *.sln
 *.vcxproj
diff --git a/Marlin/Configuration_adv.h b/Marlin/Configuration_adv.h
index a365b473bd..aea9656971 100644
--- a/Marlin/Configuration_adv.h
+++ b/Marlin/Configuration_adv.h
@@ -3023,11 +3023,19 @@
 //#define ESP3D_WIFISUPPORT   // ESP3D Library WiFi management (https://github.com/luc-github/ESP3DLib)
 
 #if EITHER(WIFISUPPORT, ESP3D_WIFISUPPORT)
-  #define WIFI_SSID "Wifi SSID"
-  #define WIFI_PWD  "Wifi Password"
   //#define WEBSUPPORT          // Start a webserver (which may include auto-discovery)
   //#define OTASUPPORT          // Support over-the-air firmware updates
   //#define WIFI_CUSTOM_COMMAND // Accept feature config commands (e.g., WiFi ESP3D) from the host
+
+  /**
+   * To set a default WiFi SSID / Password, create a file called Configuration_Secure.h with
+   * the following defines, customized for your network. This specific file is excluded via
+   * .gitignore to prevent it from accidentally leaking to the public.
+   *
+   *   #define WIFI_SSID "WiFi SSID"
+   *   #define WIFI_PWD  "WiFi Password"
+   */
+  //#include "Configuration_Secure.h" // External file with WiFi SSID / Password
 #endif
 
 /**
diff --git a/buildroot/bin/opt_set b/buildroot/bin/opt_set
index 2f6c253c9c..f23a1d3d07 100755
--- a/buildroot/bin/opt_set
+++ b/buildroot/bin/opt_set
@@ -8,4 +8,5 @@ SED=$(which gsed || which sed)
 # Logic for returning nonzero based on answer here: https://stackoverflow.com/a/15966279/104648
 eval "${SED} -i '/\(\/\/\)*\([[:blank:]]*\)\(#define \b${1}\b\).*$/{s//\2\3 ${2}/;h};\${x;/./{x;q0};x;q9}' Marlin/Configuration.h" ||
 eval "${SED} -i '/\(\/\/\)*\([[:blank:]]*\)\(#define \b${1}\b\).*$/{s//\2\3 ${2}/;h};\${x;/./{x;q0};x;q9}' Marlin/Configuration_adv.h" ||
-(echo "ERROR: opt_set Can't find ${1}" >&2 && exit 9)
+eval "echo '#define ${@}' >>Marlin/Configuration_adv.h" ||
+(echo "ERROR: opt_set Can't set or add ${1}" >&2 && exit 9)
diff --git a/buildroot/share/tests/esp32-tests b/buildroot/share/tests/esp32-tests
index 123d5c320c..47f5d81761 100755
--- a/buildroot/share/tests/esp32-tests
+++ b/buildroot/share/tests/esp32-tests
@@ -12,8 +12,8 @@ set -e
 restore_configs
 opt_set MOTHERBOARD BOARD_ESPRESSIF_ESP32
 opt_enable WIFISUPPORT GCODE_MACROS BAUD_RATE_GCODE
-opt_set WIFI_SSID "\"ssid\""
-opt_set WIFI_PWD "\"password\""
+opt_add WIFI_SSID "\"ssid\""
+opt_add WIFI_PWD "\"password\""
 opt_set TX_BUFFER_SIZE 64
 opt_add WEBSUPPORT
 exec_test $1 $2 "ESP32 with WIFISUPPORT and WEBSUPPORT"