What you’re seeing are probably calls from Pingbacks. If you don’t want them you can either disable them globally in the settings or just for a specific post in the “Discussion” metabox in the sidebar of that post.
You probably wouldn’t. If you did it would be to make sure it was in place already if in future you decided to make the variable dynamic or filterable. In this case I would suggest it for similar reasons to #1. You may know where $class is coming from now, but this may change in … Read more
Thanks to Jacob’s hint I got the solution. This one is working. Header set Content-Security-Policy “base-uri ‘self’; default-src ‘self’; font-src ‘self’ data: https://fonts.gstatic.com; frame-src https://www.google.com https://www.youtube.com; img-src data: ‘self’ https://secure.gravatar.com; script-src ‘self’ ‘unsafe-inline’ ; style-src ‘self’ ‘unsafe-inline’ https://fonts.googleapis.com; object-src ‘self’; form-action ‘self’; frame-ancestors ‘self’;” The difference is the data: in the ìmg-src section.
No, you don’t have to escape values that cannot be changed by someone else. You should escape output that might be changed by some other source, for example if there is a filter running on the values. Let’s say you are using wp_upload_dir() to find the upload directory – and you absolutely should, because the … Read more
JSON files are really data files: they are not a security threat per se, it’s simply that WordPress doesn’t include them in its whitelist. It really depends on who can upload the data and what you do with the data. After all, an Excel file with macros can be a security risk, and yet WordPress … Read more
probably your website is hacked. The first thing to do is: if you still have access to your website and can log in, try to put it in maintenance mode (you can use any free plugin). change your password and delete any unknown user. if your hosting has a Malware Removal Service, use it to … Read more
It has nothing to do with WordPress. Your server is configured to refuse access from other domains. All you need to enable CORS Origin. This will allow request from other domains. But it will decrease security. You might want to change the * (allow all) to your sub domain. Just put it in your .htaccess … Read more
As I see you are using reCaptcha v3 as the examples you try and it will not appear until the user score is under the minimum you added into the configuration but it is still working and checking the user score before he submits your form. anyway if you configured the plugin correctly you may … Read more
There’s two separate problems here: You have code that causes an error. That error is exposing information to end users that you don’t want to expose. The problem that’s causing #2 is that you have error printing enabled in a production environment, which is against best practice. Error reporting is controlled by a PHP configuration … Read more
There are no known security vulnerabilities in 2.9.2 If any new vulnerabilities are discovered the fix will be packported. (This has not happened but if it did we would get a version 2.9.3) WordPress does not have a backport policy that goes further than the previous major release so it is unknown when the 2.9 … Read more