Security Hardener

عمومی سوالات

Does restricting the REST API “block everything”?

No. By default it allows the index and the oEmbed namespace for basic compatibility. The rest requires an authenticated user. If you need additional public routes, do not enable the restriction or create specific solutions in your theme/plugin (with their permission_callback).

I use a CDN or proxy. What about the IP?

By default, rate limiting takes the IP from REMOTE_ADDR. If you use a trusted proxy (CDN/load balancer), define in wp-config.php:
define(‘WPH_TRUST_PROXY’, true);
With that, the plugin will try to use HTTP_CF_CONNECTING_IP or X-Forwarded-For (first element), validating the IP.

Which headers does it add exactly?

X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy: geolocation=(), microphone=(), camera=(), Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy: same-origin, and optionally Strict-Transport-Security and Content-Security-Policy (with nonce).

Does the plugin clean up its data upon uninstall?

Yes. uninstall.php deletes the main option and the rate-limit transients.