22 votes
Accepted

Hiding WordPress REST API v2 endpoints from public viewing

Is this meant to be used on sites in production? Yes. Many sites have been already using it. Is there a security risk to allowing endpoints to be viewed by anyone, such as /wp-json/wp/v2/users/ ...
wpclevel's user avatar
  • 3,419
14 votes
Accepted

Remove rel=shortlink from HTTP header

<?php add_filter('after_setup_theme', 'remove_redundant_shortlink'); function remove_redundant_shortlink() { // remove HTML meta tag // <link rel='shortlink' href='http://example.com/?p=...
Max Yudin's user avatar
  • 6,287
12 votes
Accepted

Switch from https back to http

You can try these: 1. make sure the values changed in database If you can't login to wp-admin > settings to confirm that, you can go to database, wp_options table and look for siteurl and home ...
Nabeel Khan's user avatar
11 votes
Accepted

Clarity needed on usage of multiple 403 forbidden header() functions at the beginning of the plugin files

The proper way to send a status (when WordPress is not available) is: http_response_code( 403 ); See the PHP Manual for its definition. But in Plugin files, this should never be the "default" code ...
fuxia's user avatar
  • 107k
10 votes
Accepted

How can I change HTTP headers only to posts of a specific category from a plugin

Why it doesn't work: send_headers hook is fired once the HTTP headers for caching, content etc. have been sent, but before the main query is properly initiated. That's why in_category() function doesn'...
Fayaz's user avatar
  • 8,909
8 votes

Hiding WordPress REST API v2 endpoints from public viewing

Is it possible to allow only authorized users to access an endpoint? It is possible to add a custom permission callback to your API endpoint which requires authentication to view the content. ...
Dalton Rooney's user avatar
7 votes

Why is WordPress redirecting from http to https on a local environment?

Well, at my situation... I downloaded the company website from production to localhost because I was needed to prepare a development environment for some developers. The production is using https:// ...
busythomas's user avatar
5 votes
Accepted

Divert http to https with WordPress on IIS

You'll need to update all of the URLs in your database to the HTTPS protocol: Go and download Interconnect IT's Database Search & Replace Script here Unzip the file and drop the folder where your ...
Ethan O'Sullivan's user avatar
5 votes
Accepted

How to receive HTTP POST in WP?

Easy! You have a couple of options to do so. The easiest one, but less safe, is to create a brand new PHP file in the root folder of WordPress. Let's say we will call it get_post.php and add ...
kirillrocks's user avatar
5 votes

Why is WordPress redirecting from http to https on a local environment?

Make sure you don't have installed and activated a plugin that forces a redirection to HTTPS, for example, the Really Simple SSL. If you have one, deactivate it on the localhost by renaming the plugin ...
Arif I.'s user avatar
  • 151
4 votes
Accepted

Disabling the X-Redirect-By response header

This line added to functions.php (ideally in a child theme, or a plugin) will remove it: add_filter( 'x_redirect_by', '__return_false' );
Jacob Peattie's user avatar
3 votes

HTTP Error when uploading mp4 video file

In my case the cause was plugin All In One WP Security an its "Basic Firewall Settings". The above firewall features are applied via your .htaccess file and one if these features is "Limit file upload ...
David Najman's user avatar
3 votes

How to receive HTTP POST in WP?

I would like to give an example to @Mark Kaplun's answer. You can register an endpoint to process your http post requests using register_rest_route like this:- /** first create a function for ...
njmwas's user avatar
  • 131
3 votes

How to receive HTTP POST in WP?

Since 4.4 and above wordpress has an official end point for "API" type of access - wp-json, which you can extend by defining you own extension point and handler with register_rest_route, never tried ...
Mark Kaplun's user avatar
  • 23.3k
3 votes
Accepted

wp_remote_get() not retrieving pages properly

The HTTP request sent by wp_remote_get() is different from the one that a browser sends. E.g the user-agent is different (see documentation). Some websites respond differently based on this. The ...
zendka's user avatar
  • 266
3 votes
Accepted

All content is HTTPS, but browsers warn of HTTP mixed content

You have "www.wisconsinwetlands.org" URLs redirecting to insecure "http://wisconsinwetlands.org". The cases you have used these is in the images on the page. Every image that is set as "https://www."...
butlerblog's user avatar
  • 4,986
3 votes

Wordpress - https : Css and Js files are not working (load on http instead of https)

Add this code in to wp-config.php just before - require_once ABSPATH . 'wp-settings.php'; line if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') $_SERVER['HTTPS']='on';
VKS's user avatar
  • 43
2 votes

Serving HTTP and HTTPS from one installation

An easy solution is to use .htaccess rules. #Redirect HTTP to HTTPS RewriteCond %{HTTPS} off RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Jarod Thornton's user avatar
2 votes

If Modified Since HTTP Header

I tried the code from cybmeta but the date wasn't being set correctly. I am not entirely sure the reason, but after investigating I found the Add Headers plugin which is now deprecated but was a good ...
Mojamba's user avatar
  • 114
2 votes
Accepted

Errors on a single host using wp_remote_get() unless sslverify is set to false

This is probably the wrong place to get into the details of certificate verification, and I am not sure I understand all of it so this answer going to focus on the wordpress API. The issue with ...
Mark Kaplun's user avatar
  • 23.3k
2 votes

Hiding WordPress REST API v2 endpoints from public viewing

Here is what I have used to block all non-logged in users from using the REST API at all: add_filter( 'rest_api_init', 'rest_only_for_authorized_users', 99 ); function rest_only_for_authorized_users($...
squarecandy's user avatar
2 votes
Accepted

Upgrade to SSL Breaks Admin Dashboard

Problem solved! The cause turned out to be dead simply. One of the mod_security rules was interfering with the admin dashboard loading. I didn't notice this earlier because I had failed to check ...
Mike P's user avatar
  • 51
2 votes

Upgrade to SSL Breaks Admin Dashboard

Not sure what plugin you are using to enforce SSL, but I would disable it to prevent conflicts with the possible solution below. To make sure you've updated all of your URLs to the HTTPS, do the ...
Ethan O'Sullivan's user avatar
2 votes
Accepted

Can't login to Dashboard when changing site URL to HTTPS

Login to your cpanel and go to php my admin, then find your db and there table wp_options, inside you will see URL of your website,2 fields. Change it how you like.
dado's user avatar
  • 119
2 votes
Accepted

How are both HTTP and HTTPS versions displaying?

If you can access the SSL version of your blog without a problem, then it means you can redirect all your traffic to it. To do so, take these 2 steps: Access your database using PhpMyAdmin or any ...
Johansson's user avatar
  • 15.3k
2 votes

Get full URL of images in media library including http://

I'm sure some plugin or your theme modifies your attachment url. Try to find wp_get_attachment_url hook in your code or simply create your own with high priority this way: add_filter('...
Anton Lukin's user avatar
2 votes
Accepted

Several times request to load plugins when sending one request

That might well be, but that's alright. There might be redirects happening, and those will result in multiple requests. The WordPress-Cron System relies on AJAX-requests, those will also show up in ...
janh's user avatar
  • 2,728
2 votes

How to get value of custom http header?

I checked amazon.com website for retrive X-Amz-Cf-Id header which I belive is not a standard header and for me it is working fine: function wpse_288865_featch_header() { $response = ...
kierzniak's user avatar
  • 2,432
2 votes
Accepted

WordPress index.php seems to perform unwanted redirect 301

It sounds like both Home URL and Site URL for your blog are set to http://test.blog, while your server accepts both http://test.blog and http://www.test.blog. If you access the latter, WordPress will ...
swissspidy's user avatar
  • 3,814
2 votes

Local WordPress with WAMP downloads files out of Nowhere

So I've come to a conclusion after doing a couple of tests in my local environment. It appears whenever I go (literally just click) to the page to edit permalinks in the admin area, the .htaccess file ...
mau's user avatar
  • 31

Only top scored, non community-wiki answers of a minimum length are eligible