0

I have a page on my website that is currently accessible through http://domain.com/my-account/. This page also has some children pages that follow the same permalink structure

Is there any importance in adding additional user information to the permalink for security reasons? I was thinking about something like http://domain.com/my-account/user-ID.

It seems like it wouldn't really make any difference but I was wondering if it is recommended to do this. If so, is there a Wordpress function that makes this easy to implement?

Thanks

Improve this question
1

If such page is available only for users that are logged in (and I guess that's the point of having "my-account" page), then there is no reason to add anything more to that link. User has to be logged in to access such page and he will be redirected to that page after logging in.

On the other hand it is very important, that you use nonces on any actions, that are performed in these pages - this will protect your users from XSS attacks. And of course, every action performed in there should also check, if user can perform that action (let's say user wants to delete his order/article - you have to check if current user is permitted to do anything with given article, etc.).

Improve this answer
  • Thanks for your answer. The reason I was originally thinking about doing this is to prevent these pages from showing up in the search. I don't want users who are not logged in to see a "Edit Profile" page in their search results. Maybe I should look for a different way of doing this though. – Philipp K Jul 30 '18 at 7:54
  • So it's even more important, that you have only one my-account page and set it not to be indexed by search engines. – Krzysiek Dróżdż♦ Jul 30 '18 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.