[wp-trac] [WordPress Trac] #62105: scraping error text while in normal operation

[WordPress Trac]

#62105: scraping error text while in normal operation
----------------------------+-----------------------------
 Reporter:  georgwordpress  |      Owner:  (none)
     Type:  defect (bug)    |     Status:  new
 Priority:  normal          |  Milestone:  Awaiting Review
Component:  Bootstrap/Load  |    Version:
 Severity:  normal          |   Keywords:
  Focuses:                  |
----------------------------+-----------------------------
 For error detection and rollback functions (e.g. when auto-updating
 plugin/theme files or editing files in the backend), WordPress also starts
 a loopback request to the homepage.
 This loopback request is made with special parameters
 (/?wp_scrape_key&wp_scrape_nonce), so WordPress starts special handling of
 this request.

 However, this special treatment also occurs during normal operation (e.g.
 no maintenance, anonymous users without login).

 Every request to the home URL with “/?wp_scrape_key&wp_scrape_nonce” is
 answered by WordPress with a simple text:

 {{{
 ###### wp_scraping_result_start: ######{"code": "scrape_nonce_failure",
 "message": "Scrape key verification failed. Please try again."}######
 wp_scraping_result_end : ### ###
 }}}

 and the http code is 200 = OK.

 Check out examples of homepages built with WordPress:
 https://wordpress.org/?wp_scrape_key&wp_scrape_nonce
 https://www.whitehouse.gov/?wp_scrape_key&wp_scrape_nonce

 As one result, the home URL and the scraping error text is also indexed by
 search engines.

 This special handling of requests with scraping parameters should only be
 done when necessary:
 e.g.:
 - in maintenance mode
 - when a user is logged in

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/62105>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform