WordPress Security for Media and Publishing Sites

Media and publishing organizations rely heavily on WordPress for content management. These high-traffic, high-profile sites face unique security challenges including content theft, defacement attacks, source protection, and editorial workflow security.

Unique Challenges for Media Sites

• High visibility - Attractive targets for defacement
• Multiple authors - Large editorial teams with varying access
• Source protection - Confidential contributor information
• Content value - Premium content worth stealing
• Tight deadlines - Security can't slow publishing

Editorial Workflow Security

Role-Based Access

// Custom publishing roles
function create_publishing_roles() {
    // Reporter - can submit drafts only
    add_role('reporter', 'Reporter', array(
        'read' => true,
        'edit_posts' => true,
        'delete_posts' => false,
        'publish_posts' => false
    ));

    // Editor - can publish and edit others
    add_role('section_editor', 'Section Editor', array(
        'read' => true,
        'edit_posts' => true,
        'edit_others_posts' => true,
        'edit_published_posts' => true,
        'publish_posts' => true,
        'delete_posts' => true,
        'manage_categories' => true
    ));

    // Managing Editor - full editorial control
    add_role('managing_editor', 'Managing Editor', array(
        'read' => true,
        'edit_posts' => true,
        'edit_others_posts' => true,
        'edit_published_posts' => true,
        'publish_posts' => true,
        'delete_posts' => true,
        'delete_others_posts' => true,
        'manage_categories' => true,
        'moderate_comments' => true
    ));
}
register_activation_hook(__FILE__, 'create_publishing_roles');

Editorial Approval Workflow

// Require editor approval for publishing
function require_editor_approval($data, $postarr) {
    $user = wp_get_current_user();

    // Reporters cannot directly publish
    if (in_array('reporter', $user->roles)) {
        if ($data['post_status'] === 'publish') {
            $data['post_status'] = 'pending';

            // Notify editors
            notify_editors_pending_review($postarr['ID']);
        }
    }

    return $data;
}
add_filter('wp_insert_post_data', 'require_editor_approval', 10, 2);

Content Protection

Prevent Content Scraping

// Rate limit content access
function rate_limit_content_access() {
    if (is_single() || is_page()) {
        $ip = wpfs_get_client_ip();
        $key = 'content_access_' . md5($ip);
        $count = get_transient($key) ?: 0;

        if ($count > 100) { // 100 pages per hour
            wp_die('Access rate limit exceeded. Please try again later.');
        }

        set_transient($key, $count + 1, HOUR_IN_SECONDS);
    }
}
add_action('template_redirect', 'rate_limit_content_access');

// Block known scrapers
function block_content_scrapers() {
    $scrapers = array(
        'HTTrack', 'WebCopier', 'WebZIP', 'Teleport',
        'wget', 'curl', 'python-requests'
    );

    $user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';

    foreach ($scrapers as $scraper) {
        if (stripos($user_agent, $scraper) !== false) {
            header('HTTP/1.1 403 Forbidden');
            exit;
        }
    }
}
add_action('init', 'block_content_scrapers', 1);

Paywall Protection

// Secure premium content
function protect_premium_content($content) {
    global $post;

    if (!get_post_meta($post->ID, 'premium_content', true)) {
        return $content;
    }

    if (!is_user_logged_in() || !current_user_can('access_premium')) {
        // Show teaser only
        $teaser_length = 300;
        $teaser = wp_trim_words(strip_tags($content), 50);

        return $teaser . '

            
This is premium content. Subscribe to continue reading.
            Subscribe Now
        
';
    }

    return $content;
}
add_filter('the_content', 'protect_premium_content');

Source Protection

Anonymous Tip System

// Secure anonymous submission
function handle_anonymous_tip($data) {
    // Strip all identifying information
    unset($data['ip_address']);
    unset($data['user_agent']);

    // Generate anonymous ID
    $data['anonymous_id'] = 'TIP-' . wp_generate_password(12, false);

    // Encrypt sensitive details
    $data['content'] = encrypt_for_editors($data['content']);

    // Store without logging
    $wpdb->insert(
        $wpdb->prefix . 'anonymous_tips',
        $data,
        array('%s', '%s', '%s')
    );

    return $data['anonymous_id'];
}

Defacement Prevention

Content Integrity Monitoring

// Monitor for unauthorized content changes
function monitor_content_changes($post_id, $post_after, $post_before) {
    // Compare content
    if ($post_before->post_content !== $post_after->post_content) {
        $user = wp_get_current_user();

        // Log the change
        log_content_change(array(
            'post_id' => $post_id,
            'user_id' => $user->ID,
            'timestamp' => current_time('mysql'),
            'content_before' => $post_before->post_content,
            'content_after' => $post_after->post_content
        ));

        // Alert on suspicious patterns
        if (contains_suspicious_content($post_after->post_content)) {
            send_security_alert('Suspicious content change detected', array(
                'post_id' => $post_id,
                'user' => $user->user_login
            ));
        }
    }
}
add_action('post_updated', 'monitor_content_changes', 10, 3);

DDoS Protection

• CDN with DDoS mitigation
• Rate limiting on all endpoints
• Caching for high-traffic events
• Scalable infrastructure

Conclusion

Media sites need robust security that doesn't impede fast-paced publishing workflows. Balance editorial flexibility with access controls, content protection, and defacement prevention.