Hi takanomi, some details to explain the reason of this salt file:
this plugin just creates one file called wp-link-status-salt.php directly into the wp-content directory, so that directory must be writable by the web server (recommended 755 permissions). The CHMOD is used to ensure the right permissions 0644 to the file (not the directory) according the WordPress permissions scheme:
https://codex.wordpress.org/Changing_File_Permissions
There is a specific script of this plugin that runs without starting WordPress (when doing the HTTP request to check an URL status). The reason is to avoid performance problems during the URL checks, it can take some time and so it is not connecting to database or run other plugins.
To avoid external calls to this script foreign of this project, we have implemented a sort of WordPress nonce system in order to securize URLs and do not allow access outside of the scope of this plugin. This system needs a seed string or salt to ensure not replicable secure arguments, but it is not possible to use the salt strings from the wp-config.php file due the restrictions of plugin guidelines (this file only can be loaded from WordPress), so a new specific salt is created just once.
Kind regards,
Pau
Hi Pau
Appreciate the clarification, many thanks.
Steve
Hi Pau,
Does this file get removed when the plugin is deactivated? I just found it in a copy of another installation where I wasn’t using the plugin. It may be that I cloned the site and your plugin was active at the time, but I don’t think so. I suspect the file may be just left in the wp-content directory.
