🔒 Security
Security best practices and configuration for Threadwp.
Security Headers
Recommended security headers for production deployment
Apache Configuration
# Apache .htaccess
Header always set X-Content-Type-Options nosniff
Header always set X-Frame-Options DENY
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"Rate Limiting
Implement custom rate limiting for chat messages
Custom Rate Limits
// Implement rate limiting
add_filter('threadwp_message_rate_limit', function($limit, $user_id) {
// Allow 60 messages per minute for regular users
if (user_can($user_id, 'moderate_comments')) {
return 120; // Higher limit for moderators
}
return 60;
}, 10, 2);Best Practices
API Keys
Rotate regularly and store securely
Input Validation
All messages are sanitized and validated
Permission Checks
Thread access validated per request
Security Considerations
CORS Configuration
Restrict origins in production
SSL/TLS Required
WebSocket connections need HTTPS
Data Privacy
Follow GDPR and local privacy laws
