---
title: "Security and limits"
description: "Permission checks, upload handling, and the limits that slow down spam and password guessing."
---
Every REST request checks the member's permission and the WordPress nonce. Posts, comments and profile text are cleaned before they are saved and shown. Link previews only fetch public web addresses on ports 80 and 443. The request goes to the public address the link resolved to, and every redirect is checked again.
| Action | Limit per member |
| --- | --- |
| New posts | 5 a minute |
| Comments | 20 a minute |
| Edits of posts and comments | 20 a minute |
| Image uploads | 20 a minute, up to 30 images not yet posted |
| Likes and saves | 60 a minute |
| Joining or leaving spaces | 20 a minute |
| Invitations | 30 a minute |
| Profile saves | 20 a minute |
| Reports | 10 a minute |
| Messages | 30 a minute |
| New events | 10 an hour. Counted only after the form is valid. |
| Starting a call Pro | 10 a minute. Joining a call that is already running does not count. |
| Shop requests Pro | 3 an hour |
| New shop products Pro | 10 a minute |
| Edits of shop products Pro | 30 a minute |
| Members mentioned in one post or comment | 20 |
Logging in and signing up have their own limits, which apply to everyone:
| Action | Limit |
| --- | --- |
| Wrong passwords for one account | 5 in 15 minutes from one network address, 20 in 15 minutes in total. The limit for one network address applies only after failed attempts; a correct password is never refused. |
| Wrong login codes for one login Pro | 5, then the member logs in again |
| Wrong login codes for one account Pro | 10 in 15 minutes and 30 a day. The member gets an email when the daily limit is reached. |
| Login codes by email for one account Pro | 10 an hour |
| New accounts from one network address | 5 an hour |
| Password reset emails | 3 an hour for one account, 5 requests in 15 minutes from one network address |
Change these with the `spacebay_auth_attempts` filter. They cover the community login page; to also limit attempts on `wp-login.php`, use a login protection plugin or your host's firewall. If your site is behind a proxy or CDN that hides visitor addresses, return the real address with the `spacebay_client_ip` filter, otherwise all visitors share one limit. With Pro, authenticator keys are stored encrypted, and backup codes and emailed codes are stored as hashes.
For the other actions, administrators are not limited. Change limits with the `spacebay_rate_limit` filter. Images can be up to 8000 pixels on the longest side; the server's memory limit can lower this.
## Images and privacy
Uploads are stored in a private folder, `wp-content/uploads/spacebay-private//`. Files get random names. The original file name is never kept. Your web server does not send files from this folder directly.
A private image is shown through a checked address, `your-site-url/?spacebay_media=ID`. SpaceBay sends it only to people who may see it:
- **Images in chats:** only the members of that conversation. Group members see only images in messages sent since they joined.
- **Images in private spaces:** only people who can read the post.
- **An upload not yet posted:** only the member who uploaded it.
- **A reported message:** staff can see its images.
Logged-out visitors and other members get "Image not found".
Only avatars, cover images and images in posts of public, published spaces are normal public files. If a space turns private or is archived, its images move to private storage. They move back if the space opens again.
**nginx sites need one rule.** Apache and IIS are handled by files the plugin writes in the folder. nginx ignores those files, so add this to your server config:
```nginx
location ^~ /wp-content/uploads/spacebay-private/ { internal; }
```
What SpaceBay does to protect members:
- Photo details such as GPS location and camera are removed from every uploaded image.
- GIF images keep their animation, so they are checked for hidden code instead, and refused if any is found.
- Images that are uploaded but never posted are removed after a day. Images are deleted with their post, and with their member.