Unverified50% confidenceFactExact time
Application password authentication depends on the site enabling HTTPS; in a pure HTTP environment WordPress will refuse to generate it; some security plugins (such as Wordfence) block the REST API by default or add extra interception to application password authentication, causing requests to fail with error messages pointing in unrelated directions.
1
Sources
50%
Confidence
Long-term
Relevance
10/15/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedModern browsers display a 'Not Secure' warning for HTTP websites, and certain features such as accessing geolocation and camera permissions are only available to HTTPS websites.71% similarUnverifiedIf the application running on a hidden service itself has vulnerabilities (such as error pages that leak server information), the true identity may still be exposed.70% similarUnverifiedThe Webhook is the only entrance through which the external world enters the workflow; once it leaks, anyone can forge messages to trigger the process, so Webhook configuration needs attention to security.70% similarUnverified防御SSRF需对用户可控的URL做协议白名单、禁止访问内网地址、过滤file://等危险协议70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1035237API
curl https://kongchang.com/api/v1/knowledge/claims/1035237MCP
get_claim(id=1035237)