The WordPress Hosting Handbook is a documentation repository. It does not ship WordPress core, plugins, themes, hosting software, or server packages.

This policy covers security-sensitive issues in this repository's documentation and GitHub configuration. It does not define support for WordPress software versions, hosting stacks, plugins, themes, server packages, or hosting platforms.

For WordPress core, plugins, themes, WordPress.org, or the wider WordPress ecosystem, follow the official WordPress security reporting guidance. WordPress core vulnerabilities should be reported through the WordPress HackerOne program.

Do not report exploitable security vulnerabilities in public GitHub issues or pull requests.

If the vulnerability is in a hosting platform, server package, or other third-party project, report it to that project or vendor through their security reporting process.

If you find an insecure, outdated, or unclear recommendation in the Hosting Handbook documentation, open a public issue in this repository:

https://github.com/WordPress/hosting-handbook/issues

Include the affected page, the specific recommendation, and any safer source or replacement guidance you are suggesting. Do not include exploit details or private vulnerability information in public issues.