Private posts can only be retrieved by a properly authenticated user via the REST API so, I’d argue, things are safe when using https.
That’s what concerns me. No additional security other than a username/password can be used with the REST API to retrieve private posts, and I had a blog hacked once using a security error in WordPress. There should be a stronger authentication (maybe two factor) for the REST API too. Sure, I could disable it altogether, but that’s also annoying.
I’m just not comfortable storing private stuff on WordPress I think.
@colinwalker I also open source the import script for Day One to WordPress I mentioned yesterday. Maybe somebody else will need it. decoding.io/2018/05/4...
@zsbenke I’m going to do a full write-up of what I’ve been doing but one option is to register a custom post type and not include support for the Rest API.
@zsbenke definitely have thought about it many times. Thanks for the link and the work on the script! (Ugh. Ruby!)
