Title: WAC POST Author: desarrollowac Published: اپریل 23, 2026 Last modified: سپتامبر 22, 2026 --- جستجوی افزونه‌ها ![](https://ps.w.org/wac-post/assets/banner-772x250.png?rev=3513284) ![](https://ps.w.org/wac-post/assets/icon-256x256.png?rev=3513284) # WAC POST توسط [desarrollowac](https://profiles.wordpress.org/desarrollowac/) [دانلود](https://downloads.wordpress.org/plugin/wac-post.4.2.1.zip) * [جزئیات](https://fa-af.wordpress.org/plugins/wac-post/#description) * [نقد و بررسی‌ها](https://fa-af.wordpress.org/plugins/wac-post/#reviews) * [نصب](https://fa-af.wordpress.org/plugins/wac-post/#installation) * [توسعه](https://fa-af.wordpress.org/plugins/wac-post/#developers) [پشتیبانی](https://wordpress.org/support/plugin/wac-post/) ## توضیحات The **WAC POST** plugin provides a robust integration between the WeAreContent platform and WordPress sites. It registers two specialized REST API endpoints designed for secure, high-performance content delivery. These endpoints are strictly protected by a three-layer security model: 1. **IP Whitelisting:** Access is only granted to authorized IP addresses (local and remote dynamic lists). 2. **Application Key:** Every request must include a valid `X-WACPO- App-Key` header, compared using a timing-safe check. 3. **Author Capability Check:** The configured Default Content Author must have permission to publish posts, verified server-side on every request. No WordPress username, password, or native Application Password is required to authorize the connection. Content received through the API is attributed to the Administrator or Editor selected in **Default Content Author**. #### Security design note (v4.2.0) Earlier versions additionally required a native WordPress Application Password tied to a specific user account. That requirement has been intentionally removed: it did not add meaningful security on top of the Application Key, but it forced every site owner to create a WordPress user and generate an application password by hand, which was the leading cause of failed/abandoned setups. The security boundary has not weakened — it moved from “a WordPress user session plus a key” to “two independent, site-owner-controlled secrets that must both match” (Application Key + IP address), plus a real server-side capability check against the configured Default Content Author (fails closed if that user cannot publish posts). Author attribution, which used to be inferred implicitly from the WordPress user session, is now an explicit, admin-only setting that can only ever resolve to a real local user, never to caller- supplied data. **Available Endpoints:** * `POST /wp-json/wac/v2/create-and-seo-post`: Create new posts including featured images, secondary media, and full SEO metadata. * `POST/ wp-json/wac/v2/postsys`: Update SEO metadata and keywords for existing posts. * ` GET /wp-json/wac/v2/ping`: Lightweight, read-only connectivity check to verify the Application Key and see the configured default author, without creating any content. ### External Services This plugin relies on external services provided by WeAreContent to ensure secure integration and media processing. By using this plugin, you acknowledge and agree to the terms of these third-party services: 1. **WeAreContent Auth-IP List:** 2. * **Service:** A remote security list hosted at app.wearecontent.com. * **Purpose:** Provides a dynamic list of authorized MD5 IP hashes to secure REST API endpoints via IP Whitelisting. * **Data processed:** The plugin only fetches security hashes from the server; no user or website data is transmitted to WeAreContent during this process. * **Terms of Service:** https://www.wearecontent.com/terminos-y-condiciones * **Privacy Policy:** https://www.wearecontent.com/tratamiento-de-datos 3. **WeAreContent Media Server:** 4. * **Service:** A dedicated media hosting platform (files.wearecontent.com). * **Purpose:** Allows the plugin to download and sideload featured images and extra media assets directly into the WordPress library. * **Data processed:** The plugin performs a secure download of media files to the local server; no personal user data is sent to the external host. * **Terms of Service:** https://www.wearecontent.com/terminos-y-condiciones * **Privacy Policy:** https://www.wearecontent.com/tratamiento-de-datos ### Features * **Secure REST Endpoints:** Dedicated points for content creation and metadata updates. * **IP Security & Proxy Support:** Advanced detection of real client IPs behind Cloudflare, Nginx, or other proxies. * **Custom Authentication:** Secure header-based validation via a unique Application Key. * **SEO Integration:** Automatic mapping of metadata for both **Yoast SEO** and** RankMath SEO**. * **Automated Media Management:** Downloads and attaches featured images and in- content media from authorized hosts. * **Smart Taxonomy Handling:** Automatically creates categories and tags if they do not exist on the site. * **Privacy Ready:** Includes suggested text for the site’s privacy policy regarding technical data processing. * **Translation Ready:** Fully internationalized with support for multiple locales. ## عکس‌های صفحه [⌊WAC POST settings page: Application Key, Default Content Author, IP whitelist, and allowed image hosts.⌉⌊WAC POST settings page: Application Key, Default Content Author, IP whitelist, and allowed image hosts.⌉[ WAC POST settings page: Application Key, Default Content Author, IP whitelist, and allowed image hosts. ## نصب 1. Upload the plugin folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress plugins screen directly. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. Go to **Settings > WAC Post** and click “Generate Secure Key” to create your Application Key. 4. Select the **Default Content Author** that content received from WeAreContent should be attributed to. 5. Copy the Application Key into the WeAreContent platform. No WordPress username or password is needed. ## سوالات متداول ### How is endpoint security guaranteed? Access is restricted by three layers: a custom Application Key (`X-WACPO-App-Key`, compared with a timing-safe function), IP address validation (via local and remote whitelists), and a server-side check that the configured Default Content Author has permission to publish posts. ### Do I need to create a WordPress user or Application Password for WeAreContent? No. Starting with version 4.2.0, the plugin no longer relies on WordPress user logins or native Application Passwords. You only need to copy the Application Key generated on the plugin’s settings page and choose a Default Content Author. ### Which SEO plugins are supported? The plugin automatically detects and maps SEO titles, descriptions, and focus keywords for **Yoast SEO** and **RankMath SEO**. ### Is it safe for the plugin to download external images? Yes. The plugin uses a whitelist of allowed hosts (e.g., `files.wearecontent.com`), validates MIME types, and checks file sizes before processing and adding them to the library. ### Does the plugin handle data privacy? Yes. It includes a privacy policy content generator to inform users about technical data processing and authorized external connections. ### What happens if a post category does not exist? The plugin will automatically create the category or tag using the name or slug provided in the REST request. ## نقد و بررسی‌ها نقد و بررسی‌ای برای این افزونه یافت نشد. ## توسعه دهندگان و همکاران “WAC POST” نرم افزار متن باز است. افراد زیر در این افزونه مشارکت کرده‌اند. مشارکت کنندگان * [ desarrollowac ](https://profiles.wordpress.org/desarrollowac/) [ترجمه “WAC POST” به زبان شما.](https://translate.wordpress.org/projects/wp-plugins/wac-post) ### علاقه‌ مند به توسعه هستید؟ [کد را مرور کنید](https://plugins.trac.wordpress.org/browser/wac-post/), را بررسی کنید [مخزن SVN](https://plugins.svn.wordpress.org/wac-post/), یا مشترک شوید [گزارش توسعه](https://plugins.trac.wordpress.org/log/wac-post/) توسط [RSS](https://plugins.trac.wordpress.org/log/wac-post/?limit=100&mode=stop_on_copy&format=rss). ## گزارش تغییرات #### 4.2.1 * Fixed: content sent via `content` was being stripped of all HTML (paragraphs, headings, bold) before it could be sanitized with `wp_kses_post()`, because the request-wide sanitization pass ran `sanitize_text_field()` on every field indiscriminately, including `content`. The `content` field is now excluded from that generic pass and sanitized with `wp_kses_post()` instead, so paragraph and heading formatting is preserved as intended. * Improved: IP addresses pasted into “Authorized IP Hash(es)” are now automatically converted to their hash before being saved, so a site’s real IP is never stored in plain text by mistake. Values that are already a hash are left untouched. #### 4.2.0 Authentication redesign (deliberate, not a regression — see “Security design note” above and inline docblocks in class-wacpo-security.php for the full rationale): * Removed dependency on WordPress user login and native Application Passwords for API authentication; this was a significant source of setup friction and support requests for site owners. * Added a “Default Content Author” setting, editable only by users with `manage_options`, to explicitly attribute posts created via the API— this value is always a real local user ID (falling back to the site’s first Administrator), never derived from request input. * Added a server-side capability check against the configured Default Content Author (fails closed with a 403 error if that user cannot publish posts), in addition to the Application Key + IP whitelist. #### 4.1.4 * Hardened the Application Key comparison to use `hash_equals()`, preventing timing attacks (previously used a direct string comparison). * Added a `GET /wp-json/wac/v2/ping` endpoint so the Application Key and WordPress permissions can be verified without creating any content. #### 4.1.3 * Added management menu in the admin dashboard. * Implemented full internationalization (i18n) support. * Optimized security logic and code standards for WordPress.org compliance. #### 4.1.2 * Added support for detecting real client IP behind proxies/CDN (Cloudflare, Nginx, etc.). * Added support for RankMath SEO integration. * Improved logging for IP detection debugging. #### 4.1.1 * Added IP restrictions and dynamic remote validation. #### 1.0.0 * Initial plugin release. ## اطلاعات * Version **4.2.1** * Last updated **1 روز پیش** * Active installations **کمتر از 10** * WordPress version ** 5.0 یا بالاتر ** * Tested up to **7.1.2** * PHP version ** 7.4 یا بالاتر ** * Language * [English (US)](https://wordpress.org/plugins/wac-post/) * Tags * [posts](https://fa-af.wordpress.org/plugins/tags/posts/)[rankmath](https://fa-af.wordpress.org/plugins/tags/rankmath/) [rest-api](https://fa-af.wordpress.org/plugins/tags/rest-api/)[seo](https://fa-af.wordpress.org/plugins/tags/seo/) [Yoast](https://fa-af.wordpress.org/plugins/tags/yoast/) * [نمایش پیشرفته](https://fa-af.wordpress.org/plugins/wac-post/advanced/) ## امتیازها No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/wac-post/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/wac-post/reviews/) ## مشارکت کنندگان * [ desarrollowac ](https://profiles.wordpress.org/desarrollowac/) ## پشتیبانی چیزی برای گفتن دارید؟ نیاز به کمک دارید؟ [مشاهده انجمن پشتیبانی](https://wordpress.org/support/plugin/wac-post/)