Only Self Pings

Najczęściej zadawane pytania

How does the allowed URL list work?

Enter complete http:// or https:// URLs, separated by newlines or commas.

Protocol (HTTP/HTTPS), domain and port must match. The destination’s path must match an allowed path or sit beneath it.

For example, https://example.com/blog allows https://example.com/blog and https://example.com/blog/article. It does not allow https://example.com/blogger, https://example.com.evil.test/blog or https://other.example.com/blog.

• HTTP and HTTPS are separate: add both if you need both.
• Domain names are case-insensitive; paths are case-sensitive. A final slash on an allowed URL is optional.
• An omitted HTTPS port is equivalent to :443; an omitted HTTP port is equivalent to :80.

A root URL such as https://example.com/ allows every path on that origin. For a WordPress site installed under a subdirectory, keep that directory in the URL to restrict pings to it.

Allowed entries must not contain credentials, query strings or fragments. A permitted destination may have a query string or fragment; matching uses its origin and path. Plain WordPress permalinks such as https://example.com/?p=123 work with a root URL entry. International domain names should use their ASCII/Punycode form.

Relative URLs, unsupported schemes, malformed URLs, dot segments and ambiguous encoded path separators are rejected. This plugin does not expand relative URLs; it filters the destinations supplied by WordPress.

What does an empty list mean?

Saving an empty list blocks all outgoing pingbacks handled by this plugin, including self-pings. A missing or structurally damaged option defaults to your current public site URL. Invalid entries within a saved list are ignored, not treated as permission to ping any site.

What changes when upgrading from 1.0?

Your saved list is retained, but URL matching is deliberately stricter. External HTTPS URLs are no longer allowed automatically. Lookalike hostnames and partial path matches are blocked. HTTP and HTTPS are separate, and paths are case-sensitive.

Review your settings after upgrading, particularly if your site moved to HTTPS or another domain. Saved URLs are not automatically rewritten. Old entries containing query strings, fragments, credentials or ambiguous paths no longer allow pings; replace them with the intended origin/path rule. Saving the settings warns about invalid entries and removes them.

Does this make my site private or stop incoming pings?

No. It filters outgoing pingback target URLs in WordPress’s pre_ping hook. It does not restrict incoming pingbacks, trackbacks, update services, visitor referrers, search engines or HTTP requests made by other plugins.

Allowed pages can redirect or advertise a pingback endpoint on another host. WordPress handles that discovery and delivery; this plugin does not enforce an HTTP firewall over those later requests. Only allow sites you trust.

Will this create internal backlinks on a password-protected site?

Not necessarily. The receiving pingback service normally needs to fetch and verify the linking article. Authentication, disabled XML-RPC/pingbacks, hosting rules or other plugins can prevent delivery. This plugin preserves eligible self-pings; it does not implement an independent backlink index.

What happens on Multisite?

The plugin can be activated per site or network-wide. Each site has its own allowed URLs and Settings page. A site without saved settings defaults to its current public site URL. There is no network-wide allowlist.

What happens when I deactivate or delete the plugin?

Deactivation keeps the settings. Deleting the plugin removes its own OnlySelfPingsOpts option, including per-site options on Multisite. It never edits or deletes WP-HideRefer settings.