WAC POST

The WAC POST plugin provides a robust integration between the WeAreContent platform and WordPress sites. It registers two specialized REST API endpoints designed for secure, high-performance content delivery. These endpoints are strictly protected by a three-layer security model:

1. IP Whitelisting: Access is only granted to authorized IP addresses (local and remote dynamic lists).
2. Application Key: Every request must include a valid X-WACPO-App-Key header, compared using a timing-safe check.
3. Author Capability Check: The configured Default Content Author must have permission to publish posts, verified server-side on every request. No WordPress username, password, or native Application Password is required to authorize the connection. Content received through the API is attributed to the Administrator or Editor selected in Default Content Author.

Security design note (v4.2.0) Earlier versions additionally required a native WordPress Application Password tied to a specific user account. That requirement has been intentionally removed: it did not add meaningful security on top of the Application Key, but it forced every site owner to create a WordPress user and generate an application password by hand, which was the leading cause of failed/abandoned setups. The security boundary has not weakened — it moved from "a WordPress user session plus a key" to "two independent, site-owner-controlled secrets that must both match" (Application Key + IP address), plus a real server-side capability check against the configured Default Content Author (fails closed if that user cannot publish posts). Author attribution, which used to be inferred implicitly from the WordPress user session, is now an explicit, admin-only setting that can only ever resolve to a real local user, never to caller-supplied data. Available Endpoints:

• POST /wp-json/wac/v2/create-and-seo-post: Create new posts including featured images, secondary media, and full SEO metadata.
• POST /wp-json/wac/v2/postsys: Update SEO metadata and keywords for existing posts.
• GET /wp-json/wac/v2/ping: Lightweight, read-only connectivity check to verify the Application Key and see the configured default author, without creating any content.

4.2.2

• Fixed: SEO metadata sent to create-and-seo-post (titleSeo, metaDesc, focusKw) was silently discarded since 4.1.3. It is now mapped again to Yoast SEO (_yoast_wpseo_title, _yoast_wpseo_metadesc, _yoast_wpseo_focuskw) and/or Rank Math (rank_math_title, rank_math_description, rank_math_focus_keyword), depending on which plugin is active. If neither is active the post is still created and the SEO fields are skipped.
• Fixed: categories and tags were silently discarded since 4.1.3. They are resolved again by slug or name (array or comma-separated string), creating missing terms.
• Fixed: duplicate-slug detection never worked (the slug was being passed as the post status to post_exists()), and the requested slug is now verified after the post is created.
• Fixed: status is restricted again to publish, draft, pending or private (defaults to draft).
• Changed: the maximum size for images received through the API is now 1 MB for both the featured image and extra images (previously 300 KB and 200 KB, which silently discarded most images). It can be adjusted with the wacpo_max_image_bytes filter.
• Improved: the create-and-seo-post response now also returns slug, seo_meta, categories, tags and warnings (e.g. images skipped for exceeding the size limit), so the caller can confirm what was stored instead of images being dropped silently.

4.2.1

• Fixed: content sent via content was being stripped of all HTML (paragraphs, headings, bold) before it could be sanitized with wp_kses_post(), because the request-wide sanitization pass ran sanitize_text_field() on every field indiscriminately, including content. The content field is now excluded from that generic pass and sanitized with wp_kses_post() instead, so paragraph and heading formatting is preserved as intended.
• Improved: IP addresses pasted into "Authorized IP Hash(es)" are now automatically converted to their hash before being saved, so a site's real IP is never stored in plain text by mistake. Values that are already a hash are left untouched.

4.2.0 Authentication redesign (deliberate, not a regression — see "Security design note" above and inline docblocks in class-wacpo-security.php for the full rationale):

• Removed dependency on WordPress user login and native Application Passwords for API authentication; this was a significant source of setup friction and support requests for site owners.
• Added a "Default Content Author" setting, editable only by users with manage_options, to explicitly attribute posts created via the API — this value is always a real local user ID (falling back to the site's first Administrator), never derived from request input.
• Added a server-side capability check against the configured Default Content Author (fails closed with a 403 error if that user cannot publish posts), in addition to the Application Key + IP whitelist.

4.1.4

• Hardened the Application Key comparison to use hash_equals(), preventing timing attacks (previously used a direct string comparison).
• Added a GET /wp-json/wac/v2/ping endpoint so the Application Key and WordPress permissions can be verified without creating any content.

4.1.3

• Added management menu in the admin dashboard.
• Implemented full internationalization (i18n) support.
• Optimized security logic and code standards for WordPress.org compliance.

4.1.2

• Added support for detecting real client IP behind proxies/CDN (Cloudflare, Nginx, etc.).
• Added support for RankMath SEO integration.
• Improved logging for IP detection debugging.

4.1.1

• Added IP restrictions and dynamic remote validation.

1.0.0

• Initial plugin release.