Security

Security

Schemafy implements multiple layers of security across all operations.

CSRF protection

All AJAX requests use WordPress nonces. Every admin action verifies the nonce before processing.

Capability checks

Every operation checks that the current user has the appropriate WordPress capability:

• Schema management: manage_options
• Read access: edit_posts

Users without these capabilities cannot access or modify schema data.

Input sanitization

All user input is sanitized before processing or storage:

• Schema names and URLs — sanitized with sanitize_text_field
• JSON-LD data — validated before storage
• Meta tags and social fields — sanitized per field type

JSON validation

All JSON is validated before saving to the database:

1. JSON syntax validity
2. Schema.org structure (@context, @type presence)
3. Required field check for the declared type
4. Google Guidelines compliance

Invalid JSON is rejected and not stored.

SQL injection prevention

All database queries use $wpdb->prepare(). No raw user input is ever interpolated directly into SQL.

Output encoding

JSON-LD data is properly encoded when injected into HTML, preventing XSS via malformed schema content.

AI proxy security

The OpenAI API key is never stored in the plugin, in your WordPress database, or on your server. It lives exclusively on the Schemafy Vercel proxy. When you use the AI Generator, only the page content (headings, text, meta tags) is sent to the proxy — no credentials or authentication tokens are transmitted.