{"id":375050,"date":"2026-11-07T17:04:31","date_gmt":"2026-11-07T17:04:31","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/dwarpal\/"},"modified":"2026-11-07T17:03:56","modified_gmt":"2026-11-07T17:03:56","slug":"dwarpal","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/dwarpal\/","author":23446690,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.2.19","stable_tag":"1.2.19","tested":"7.1.4","requires":"5.3","requires_php":"7.2","requires_plugins":null,"header_name":"Dwarpal","header_author":"Dwarpal","header_description":"Dwarpal WP Security Plugin - firewall, malware scanning, login protection, SEO hack protection, and security monitoring for WordPress.","assets_banners_color":"351a1c","last_updated":"2026-11-07 17:03:56","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/dwarpal.net\/dwarpal-wordpress-security-plugin\/","header_author_uri":"https:\/\/dwarpal.net\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":110,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.2.19":{"tag":"1.2.19","author":"dwarpal","date":"2026-11-07 17:03:56","revision":3789977}},"upgrade_notice":{"1.2.19":"<p>Requires WordPress 5.3 or newer. Plugin Check offloading false positive on outbound allow-list is cleared.<\/p>","1.2.18":"<p>Plugin Check warnings for firewall POST inspection and REQUEST_URI handling are cleared.<\/p>","1.2.17":"<p>The Live Traffic screen loads a short list and cannot hang while the log table is large.<\/p>","1.2.16":"<p>Live traffic keeps real visits. Scanner 404s are left to the HTTP error log, and the traffic screen no longer sorts the whole table.<\/p>","1.2.15":"<p>A normal page with an embedded video is not blocked. WooCommerce IP lookups and YouTube, Vimeo, and SoundCloud previews are not written to the security log.<\/p>","1.2.14":"<p>Live traffic and security logs use the same clock as the server.<\/p>","1.2.13":"<p>Log times match the site timezone. A normal page view is not recorded as an SEO hack.<\/p>","1.2.12":"<p>Firewall now sees the real request, including public form submissions.<\/p>","1.2.11":"<p>Viewing a page is no longer recorded as an SEO hack.<\/p>","1.2.10":"<p>Live traffic shows the real response code for each request.<\/p>","1.2.9":"<p>Activation finishes without rewriting large log tables.<\/p>","1.2.8":"<p>Stops the dashboard from counting millions of log rows. Old rows are deleted in the background.<\/p>","1.2.7":"<p>Stops the full site scan from running on the first page view after activation.<\/p>","1.2.6":"<p>Stops live-traffic logging from locking database tables. Recommended for all users.<\/p>","1.2.5":"<p>Activation, file location and scheduled task fixes. Recommended for all users.<\/p>","1.2.1":"<p>Display name and WordPress.org compliance updates. Please review Threat Defense and Blocklist Monitor opt-in settings after update.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3789994,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3789994,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3789994,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3789994,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.19"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[46125,1174,1229,1184,600],"plugin_category":[54],"plugin_contributors":[291394],"plugin_business_model":[],"class_list":["post-375050","plugin","type-plugin","status-publish","hentry","plugin_tags-brute-force-protection","plugin_tags-firewall","plugin_tags-login-security","plugin_tags-malware","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-dwarpal","plugin_committers-dwarpal"],"banners":{"banner":"https:\/\/ps.w.org\/dwarpal\/assets\/banner-772x250.png?rev=3789994","banner_2x":"https:\/\/ps.w.org\/dwarpal\/assets\/banner-1544x500.png?rev=3789994","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/dwarpal\/assets\/icon-128x128.png?rev=3789994","icon_2x":"https:\/\/ps.w.org\/dwarpal\/assets\/icon-256x256.png?rev=3789994","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p><strong>Dwarpal<\/strong> (Dwarpal WP Security Plugin) protects your WordPress site from common threats, including:<\/p>\n\n<ul>\n<li><strong>Firewall Protection<\/strong> - Automatically blocks malicious requests containing SQL injection, XSS, code injection, and directory traversal attempts<\/li>\n<li><strong>Login Security<\/strong> - Protects against brute force attacks by limiting login attempts and locking out suspicious IP addresses<\/li>\n<li><strong>SEO Hack Protection<\/strong> - Detects Thai\/gambling spam, wp-config injectors, and bot cloaking via local User-Agent comparison (no Google scraping)<\/li>\n<li><strong>Bot View Scanner<\/strong> - Compares browser vs search-bot responses on your own site; scans wp-config.php and index.php for known malware signatures<\/li>\n<li><strong>Critical Options Monitor<\/strong> - Alerts when key WordPress settings (site URL, admin email, registration) are changed\u2014catches takeover and redirect hacks<\/li>\n<li><strong>Outbound Request Monitor<\/strong> - Logs outbound HTTP requests from your site to detect backdoors and data exfiltration<\/li>\n<li><strong>Security Logging<\/strong> - Comprehensive audit log of all security events for monitoring and analysis<\/li>\n<li><strong>WordPress Hardening<\/strong> - Removes WordPress version information, disables XML-RPC, and implements other security best practices<\/li>\n<li><strong>Malware Scanning<\/strong> - Scans files for malware and suspicious patterns<\/li>\n<li><strong>File Integrity Monitoring<\/strong> - Monitors core files for unauthorized changes<\/li>\n<li><strong>Two-Factor Authentication<\/strong> - Adds an extra layer of security to login<\/li>\n<li><strong>IP Blocking &amp; Whitelisting<\/strong> - Block malicious IPs and whitelist trusted ones<\/li>\n<li><strong>Live Traffic Monitoring<\/strong> - Real-time monitoring of website traffic<\/li>\n<li><strong>Vulnerability Scanner<\/strong> - Checks for known vulnerabilities in WordPress core, plugins, and themes<\/li>\n<li><strong>Threat Defense<\/strong> - Opt-in signature feed, virtual patches, auto-block reputation, and security digests<\/li>\n<li><strong>OWASP Coverage Report<\/strong> - Maps enabled controls to OWASP Top 10 categories<\/li>\n<\/ul>\n\n<h3>Features<\/h3>\n\n<h4>Firewall<\/h4>\n\n<ul>\n<li>Real-time request scanning<\/li>\n<li>Pattern-based threat detection<\/li>\n<li>Automatic blocking of malicious requests<\/li>\n<li>Configurable firewall rules<\/li>\n<\/ul>\n\n<h4>Login Security<\/h4>\n\n<ul>\n<li>Failed login attempt tracking<\/li>\n<li>IP-based lockout system<\/li>\n<li>Configurable attempt limits<\/li>\n<li>Customizable lockout duration<\/li>\n<\/ul>\n\n<h4>Security Logging<\/h4>\n\n<ul>\n<li>Complete audit trail<\/li>\n<li>Event type categorization<\/li>\n<li>IP address tracking<\/li>\n<li>Request URI logging<\/li>\n<li>User agent recording<\/li>\n<\/ul>\n\n<h4>WordPress Hardening<\/h4>\n\n<ul>\n<li>WordPress version hiding<\/li>\n<li>XML-RPC disabling<\/li>\n<li>RSD link removal<\/li>\n<li>File editing protection<\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>This plugin can optionally connect to third-party services <strong>only when you enable the related feature<\/strong> in the plugin settings. Features that call external services are <strong>off by default<\/strong> unless noted.<\/p>\n\n<h4>Google Safe Browsing \/ Transparency Report (blocklist monitoring)<\/h4>\n\n<ul>\n<li><strong>What it is<\/strong>: A Google page used to check whether your domain appears to be flagged for unsafe browsing.<\/li>\n<li><strong>When it is called<\/strong>: Only when <strong>Blocklist Monitoring<\/strong> is enabled (disabled by default; requires opt-in).<\/li>\n<li><strong>What data is sent<\/strong>: Your site domain (host) is sent as part of the request URL.<\/li>\n<li><strong>Why<\/strong>: To help you identify if your domain may be flagged and needs remediation.<\/li>\n<li><strong>Service provider<\/strong>: Google.<\/li>\n<li><strong>Terms<\/strong>: <code>https:\/\/policies.google.com\/terms<\/code><\/li>\n<li><strong>Privacy<\/strong>: <code>https:\/\/policies.google.com\/privacy<\/code><\/li>\n<\/ul>\n\n<h4>ip-api.com (GeoIP country lookup)<\/h4>\n\n<ul>\n<li><strong>What it is<\/strong>: A GeoIP service used to map an IP address to a country code.<\/li>\n<li><strong>When it is called<\/strong>: Only when <strong>Geo-blocking<\/strong> is enabled.<\/li>\n<li><strong>What data is sent<\/strong>: The visitor IP address is sent to <code>ip-api.com<\/code> to determine the country code.<\/li>\n<li><strong>Why<\/strong>: To enforce country-based access restrictions when you enable geo-blocking.<\/li>\n<li><strong>Service provider<\/strong>: ip-api.com.<\/li>\n<li><strong>Terms<\/strong>: <code>https:\/\/ip-api.com\/docs\/legal<\/code><\/li>\n<li><strong>Privacy<\/strong>: <code>https:\/\/ip-api.com\/docs\/legal<\/code><\/li>\n<\/ul>\n\n<h4>Bot View Scanner (local cloaking detection)<\/h4>\n\n<ul>\n<li><strong>What it is<\/strong>: A local scan that requests your own site URLs with different User-Agent headers (normal browser vs search bot) to detect cloaking.<\/li>\n<li><strong>When it is called<\/strong>: Only when you click <strong>Run Bot View Scan<\/strong> or enable <strong>Daily Bot View Scan<\/strong> in SEO Protection settings.<\/li>\n<li><strong>What data is sent<\/strong>: HTTP requests are made to your own site (<code>home_url()<\/code>). No data is sent to Google or third-party search engines.<\/li>\n<li><strong>Why<\/strong>: To detect SEO cloaking and wp-config\/index.php injection patterns seen in real server compromises.<\/li>\n<li><strong>External link<\/strong>: Google Search Console is linked for manual verification only (opens in your browser; the plugin does not scrape Google).<\/li>\n<\/ul>\n\n<h4>WordPress.org API (vulnerability scanner)<\/h4>\n\n<ul>\n<li><strong>What it is<\/strong>: Official WordPress.org endpoints for core\/plugin version data.<\/li>\n<li><strong>When it is called<\/strong>: When you run the vulnerability scanner.<\/li>\n<li><strong>What data is sent<\/strong>: Plugin slugs and WordPress version identifiers (standard update API usage).<\/li>\n<li><strong>Service provider<\/strong>: WordPress.org.<\/li>\n<li><strong>Terms<\/strong>: <code>https:\/\/wordpress.org\/about\/gpl\/<\/code><\/li>\n<li><strong>Privacy<\/strong>: <code>https:\/\/wordpress.org\/about\/privacy\/<\/code><\/li>\n<\/ul>\n\n<h4>Optional signature feed (Threat Defense)<\/h4>\n\n<ul>\n<li><strong>What it is<\/strong>: JSON feed of firewall, malware, and virtual-patch signatures.<\/li>\n<li><strong>When it is called<\/strong>: Only when <strong>Signature feed sync<\/strong> is enabled. If no URL is set, the plugin refreshes from its bundled <code>data\/signatures.json<\/code>. If you set a remote URL, that URL is fetched daily (or on demand).<\/li>\n<li><strong>What data is sent<\/strong>: A normal HTTPS GET to your configured feed URL. No site visitor data is included.<\/li>\n<li><strong>Why<\/strong>: To keep detection rules updatable without waiting for a full plugin release.<\/li>\n<li><strong>Important<\/strong>: Leave disabled (default) if you do not want outbound feed requests.<\/li>\n<\/ul>\n\n<h4>Optional IP reputation lookup (Threat Defense)<\/h4>\n\n<ul>\n<li><strong>What it is<\/strong>: An optional JSON reputation endpoint you configure yourself.<\/li>\n<li><strong>When it is called<\/strong>: Only when <strong>local auto-block<\/strong> and <strong>remote reputation lookup<\/strong> are both enabled and a reputation URL is set.<\/li>\n<li><strong>What data is sent<\/strong>: The visitor IP address as a query parameter.<\/li>\n<li><strong>Expected response<\/strong>: JSON such as <code>{\"block\":true,\"score\":90}<\/code>.<\/li>\n<li><strong>Important<\/strong>: Disabled by default. Do not enable unless you understand and trust the endpoint you configure.<\/li>\n<\/ul>\n\n<h4>WordPress.org compliance (storage)<\/h4>\n\n<p>Database exports and plugin-generated files are stored only under:<\/p>\n\n<pre><code>wp-content\/uploads\/dwarpal\/\n<\/code><\/pre>\n\n<p>This plugin does <strong>not<\/strong>:\n- Copy or modify <code>wp-config.php<\/code>\n- Write <code>.htaccess<\/code> to <code>wp-content\/<\/code> or WordPress core directories\n- Define <code>DISALLOW_FILE_EDIT<\/code> globally (file editor is disabled via a setting + capability filter)\n- Call remote files for CSS\/JS\/images (all assets are bundled)<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>dwarpal<\/code> folder to the <code>\/wp-content\/plugins\/<\/code> directory<\/li>\n<li>Activate the plugin through the 'Plugins' menu in WordPress<\/li>\n<li>Navigate to 'Dwarpal' in the WordPress admin menu to configure settings<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"what%20security%20features%20does%20dwarpal%20provide%3F\"><h3>What security features does Dwarpal provide?<\/h3><\/dt>\n<dd><p>Dwarpal provides firewall protection, login security, security logging, and WordPress hardening features.<\/p><\/dd>\n<dt id=\"does%20dwarpal%20affect%20site%20performance%3F\"><h3>Does Dwarpal affect site performance?<\/h3><\/dt>\n<dd><p>Dwarpal is designed to be lightweight and efficient. Security checks are performed early in the WordPress loading process to minimize performance impact.<\/p><\/dd>\n<dt id=\"can%20i%20customize%20the%20firewall%20rules%3F\"><h3>Can I customize the firewall rules?<\/h3><\/dt>\n<dd><p>Yes, firewall rules can be customized through the admin interface. Additional customization options may be available in future versions.<\/p><\/dd>\n<dt id=\"how%20does%20the%20login%20security%20work%3F\"><h3>How does the login security work?<\/h3><\/dt>\n<dd><p>The login security system tracks failed login attempts by IP address. After a configurable number of failed attempts, the IP address is temporarily locked out.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.2.19<\/h4>\n\n<ul>\n<li>Requires WordPress 5.3+. Outbound allow-list no longer trips Plugin Check offloading<\/li>\n<\/ul>\n\n<h4>1.2.18<\/h4>\n\n<ul>\n<li>Plugin Check: nonce and REQUEST_URI sanitization warnings cleared on firewall and traffic logging<\/li>\n<\/ul>\n\n<h4>1.2.17<\/h4>\n\n<ul>\n<li>Live Traffic screen reads 30 short rows and stops logging once the table is full<\/li>\n<\/ul>\n\n<h4>1.2.16<\/h4>\n\n<ul>\n<li>Live traffic no longer stores every bot 404, and the traffic screen reads only the latest rows<\/li>\n<\/ul>\n\n<h4>1.2.15<\/h4>\n\n<ul>\n<li>Firewall no longer blocks a normal page that contains an embed. IP lookups and media previews are not security events<\/li>\n<\/ul>\n\n<h4>1.2.14<\/h4>\n\n<ul>\n<li>Live traffic and security logs show the server clock<\/li>\n<\/ul>\n\n<h4>1.2.13<\/h4>\n\n<ul>\n<li>Security log times follow the site clock. Viewing a page is not logged as an SEO hack<\/li>\n<\/ul>\n\n<h4>1.2.12<\/h4>\n\n<ul>\n<li>Firewall matches SQL injection, XSS, code injection, and directory traversal in the raw URL and in public form posts<\/li>\n<\/ul>\n\n<h4>1.2.11<\/h4>\n\n<ul>\n<li>Fix: viewing a normal page is no longer logged as an SEO hack attempt<\/li>\n<\/ul>\n\n<h4>1.2.10<\/h4>\n\n<ul>\n<li>Fix: live traffic records the real HTTP status. Missing pages were stored as 200<\/li>\n<\/ul>\n\n<h4>1.2.9<\/h4>\n\n<ul>\n<li>Fix: activation no longer alters existing log tables, which timed out and returned Internal Server Error on large sites<\/li>\n<\/ul>\n\n<h4>1.2.8<\/h4>\n\n<ul>\n<li>Fix: dashboard and scans no longer run COUNT(*) on the log tables<\/li>\n<li>Fix: HTTP errors, traffic and security logs are trimmed on a schedule (7 or 30 days)<\/li>\n<li>Fix: admin pages, plugin update checks and image requests are not written to the logs<\/li>\n<\/ul>\n\n<h4>1.2.7<\/h4>\n\n<ul>\n<li>Fix: malware, integrity, vulnerability and update checks no longer start during the first page view after activation<\/li>\n<\/ul>\n\n<h4>1.2.6<\/h4>\n\n<ul>\n<li>Fix: log tables use InnoDB, and old traffic rows are deleted in small scheduled batches, so page views no longer lock the tables<\/li>\n<\/ul>\n\n<h4>1.2.5<\/h4>\n\n<ul>\n<li>Activation: database tables created with dbDelta (versioned schema, multisite aware); no output or external requests on activation<\/li>\n<li>Admin CSS\/JS load only on Dwarpal screens<\/li>\n<li>File and directory locations resolved with WordPress functions; the plugin no longer deletes core files (readme.html removal option replaced by a server block rule)<\/li>\n<li>Vulnerability scan uses WordPress core update data instead of contacting external servers<\/li>\n<li>Fix: file integrity baseline is built in time-limited batches (no timeout on large or slow sites)<\/li>\n<li>Fix: update alerts and other scheduled tasks load required WordPress admin functions before use<\/li>\n<li>Fix: uninstall now removes plugin tables, options and scheduled events<\/li>\n<li>Fix: PHP warnings on the dashboard and on Firewall \/ 2FA settings save; 404s no longer logged twice<\/li>\n<li>Fix: \"404 Exploit Attempt\" is logged only for real 404 responses (admin pages and admin-ajax requests were reported as attacks)<\/li>\n<\/ul>\n\n<h4>1.2.3<\/h4>\n\n<ul>\n<li>Security: capability checks on all admin screens and pending-user approve\/reject<\/li>\n<li>Security: nonce verification on 2FA profile save<\/li>\n<li>Fix: approving a pending user no longer triggers a fatal error<\/li>\n<\/ul>\n\n<h4>1.2.2<\/h4>\n\n<ul>\n<li>Plugin Check cleanup: text domain set to <code>dwarpal<\/code> to match plugin slug\/folder<\/li>\n<li>Removed Google hostname string patterns that falsely triggered Offloading checks<\/li>\n<li>Removed debug error_log(); hardened nonce\/sanitize handling and DB query annotations<\/li>\n<li>readme: Tested up to 7.1; shortened short description<\/li>\n<\/ul>\n\n<h4>1.2.1<\/h4>\n\n<ul>\n<li>Plugin display name set to Dwarpal; description set to Dwarpal WP Security Plugin<\/li>\n<li>WordPress.org review hardening: sanitization, escaping, opt-in external services, uploads-only storage<\/li>\n<li>Text domain remains <code>dwarpal<\/code> to match the directory slug<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Threat Defense: opt-in updatable signature\/rule feed (bundled or remote JSON)<\/li>\n<li>Virtual patches for known vulnerable plugin request patterns (no file overwrites)<\/li>\n<li>OWASP Top 10 coverage mapping and admin report<\/li>\n<li>Opt-in smarter auto-block with local reputation scoring and optional remote lookup<\/li>\n<li>Daily\/weekly security alerting digests (email)<\/li>\n<\/ul>\n\n<h4>1.1.1<\/h4>\n\n<ul>\n<li>Centralized backup storage under uploads\/dwarpal\/ via WP_Filesystem<\/li>\n<li>Removed wp-config.php copies and wp-content\/.htaccess writes<\/li>\n<li>File editor disable uses capability filter only (no DISALLOW_FILE_EDIT constant)<\/li>\n<li>Hardening PHP-block options are recommendations with copy-paste Apache rules<\/li>\n<li>Backup protection uses firewall rules only (no .htaccess modification)<\/li>\n<li>Fixed remaining text domain strings for plugin slug compliance<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Bot View Scanner: local cloaking detection (browser vs bot User-Agent) \u2014 replaces non-compliant Google search scraping<\/li>\n<li>SEO signatures from real incidents: eval\/base64, web shells, Thai SEO APIs, mass-injection markers<\/li>\n<li>Daily core file scan (wp-config.php, index.php) with admin alerts<\/li>\n<li>Blocklist monitoring remains opt-in (disabled by default)<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<li>Firewall protection<\/li>\n<li>Login security features<\/li>\n<li>Security logging<\/li>\n<li>WordPress hardening<\/li>\n<li>Admin interface<\/li>\n<\/ul>","raw_excerpt":"Firewall, malware scan, login security, and SEO hack protection for WordPress.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/375050","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=375050"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/dwarpal"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=375050"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=375050"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=375050"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=375050"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=375050"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=375050"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}