Security and limits

Every REST request checks the member’s permission and the WordPress nonce. Posts, comments and profile text are cleaned before they are saved and shown. Link previews only fetch public web addresses on ports 80 and 443. The request goes to the public address the link resolved to, and every redirect is checked again.

Action	Limit per member
New posts	5 a minute
Comments	20 a minute
Edits of posts and comments	20 a minute
Image uploads	20 a minute, up to 30 images not yet posted
Likes and saves	60 a minute
Joining or leaving spaces	20 a minute
Invitations	30 a minute
Profile saves	20 a minute
Reports	10 a minute
Messages	30 a minute
New events	10 an hour. Counted only after the form is valid.
Starting a call Pro	10 a minute. Joining a call that is already running does not count.
Shop requests Pro	3 an hour
New shop products Pro	10 a minute
Edits of shop products Pro	30 a minute
Members mentioned in one post or comment	20

Logging in and signing up have their own limits, which apply to everyone:

Action	Limit
Wrong passwords for one account	5 in 15 minutes from one network address, 20 in 15 minutes in total. The limit for one network address applies only after failed attempts; a correct password is never refused.
Wrong login codes for one login Pro	5, then the member logs in again
Wrong login codes for one account Pro	10 in 15 minutes and 30 a day. The member gets an email when the daily limit is reached.
Login codes by email for one account Pro	10 an hour
New accounts from one network address	5 an hour
Password reset emails	3 an hour for one account, 5 requests in 15 minutes from one network address

Change these with the spacebay_auth_attempts filter. They cover the community login page; to also limit attempts on wp-login.php, use a login protection plugin or your host’s firewall. If your site is behind a proxy or CDN that hides visitor addresses, return the real address with the spacebay_client_ip filter, otherwise all visitors share one limit. With Pro, authenticator keys are stored encrypted, and backup codes and emailed codes are stored as hashes.

For the other actions, administrators are not limited. Change limits with the spacebay_rate_limit filter. Images can be up to 8000 pixels on the longest side; the server’s memory limit can lower this.

Images and privacy

Uploads are stored in a private folder, wp-content/uploads/spacebay-private/<random folder>/. Files get random names. The original file name is never kept. Your web server does not send files from this folder directly.

A private image is shown through a checked address, your-site-url/?spacebay_media=ID. SpaceBay sends it only to people who may see it:

• Images in chats: only the members of that conversation. Group members see only images in messages sent since they joined.
• Images in private spaces: only people who can read the post.
• An upload not yet posted: only the member who uploaded it.
• A reported message: staff can see its images.

Logged-out visitors and other members get “Image not found”.

Only avatars, cover images and images in posts of public, published spaces are normal public files. If a space turns private or is archived, its images move to private storage. They move back if the space opens again.

nginx sites need one rule. Apache and IIS are handled by files the plugin writes in the folder. nginx ignores those files, so add this to your server config:

location ^~ /wp-content/uploads/spacebay-private/ { internal; }

What SpaceBay does to protect members:

• Photo details such as GPS location and camera are removed from every uploaded image.
• GIF images keep their animation, so they are checked for hidden code instead, and refused if any is found.
• Images that are uploaded but never posted are removed after a day. Images are deleted with their post, and with their member.