@Jan - re " A plugin is a type of admin check box. It really is trivial to implement that. As designers and developers everyone here knows or can find out how simple that is. Just look at the code as I’m sure you may have done already."

I hear what you are saying. May I offer you a couple different views to consider.

It is not trivial - and that language / thought process is exactly why I used Elite in my quotes earlier. I'm not trying to be mean / rude - I'm trying to get you guys to see beyond your not-so-walled gardens you regular guys get to live / work in.

example - xmlrpc - I realized the need to disable it. I go to the wp-repo start looking. There are a bunch of plugins that say they do it. Which ones work with 4.3? Which ones have flaws? Which ones are trustworthy? I spend a lot of time reading descriptions, support threads, looking for details. Which ones actually turn it off in a way that actually keeps my server from accepting the requests and making to hit sql and returning something? I finally chose one (not sure it does what I need it to do).

The server I need to add to first has a dozen WP sites on it - and security on that server does not allow for wp backend 'add new'.. I have to download, unzip - and ftp files in.. then go to dashboard - enable. Thank goodness I'm at home with cable connection and not in emergency need of this when at my GF's place, which does not - and ther I can't hotspot either as it gets one bar of service on the "edge" (not even 2g) network!

I can do all this - but it is NOT trivial. And I consider myself a fairly advanced WP user.

Years ago I got my mom and two aunts using wordpress - they are actually pretty fluent with a lot of things WP. However you should see their eyes gloss over when I explain who xmlrpc is being used by hackers, how we need to rush to disable, how it needs to be done - yet my two aunts use jetpack - so we can't there.. So.. I have to do more research. I find that jetpack has a module that can help with this brute force thing.. and explain that needs to be turned on. One aunt has not idea what I mean, so I have to login to her wp and dig through a ton of jetpack settings I know nothing about.

I find it, get it turned on - I heard around the tavern this works - however not knowing how it works- I wonder if it's protecting from a successful login, but not stopping the server from getting hammered by requests and sql queries - even if they never get a successful login, I still have to watch how much hammering of our php on this server is an issue.

Yeah - it's kind of an admin checkbox - but it's not.

Now all this is with a situation in which I was lucky to be enlightened about fairly early in the "this is current issue in the wild" process.

During previous WP upgrades I was not aware that WP was installing extra third party stuff - and had unknowingly sacrificed the privacy of my visitors and my crew. Only when I saw my siters hang slow and noticed a waiting for google... in the little bottom of browser - I freaked - has my site been hacked? why is my site waiting for google? I have never and will never install anything google.. had to dig.. whoa! It's not hacked it's a sneaky auto add feature..

Got to plugin repo - search- repeat process above.

I found out from others about the emoji stuff being added - dang it. Wish I had known on install of update not weeks later - repeat proces above.

I have more details and several examples.. but trying not to stress out Jeff with too many paragraphs.. Time to start bloggin' again I see.

On a lighter note, I wonder if the oembed thing would let me write a long details post about my experiences, and come to the comments here at the tavern and post an excerpt with links to my blog? Will that iframe work in comments?

LOL - that might save Jeff some paragraphs to read.. but some may change what they wrote and then what appears on Tavern may be an issue - a trusted embed okay option in comment moderation?

I am seeing people use this embed thing on one of my BP sites - it appears tumblr has this exact thing, and people are using the embed thing to auto-pull a pic and some text from their tumblr system and post on the activity of my BP thing - not sure I like it - but I guess I see where the team got the idea -

I don't think it will be long before people use it in that manner to post a gif of kittens - then come back a month later change their post to show something evil - and I have no idea if it could be used to get links from the embedded site for shady SEO - or if Ggl or some other setting in embed thing can block such abuse.. it's a new possible attack vector I have not thought enough about..

If I embed a chunk from Tavern on my site - and later Tavern is hacked and they add nuclear exploit to all files served.. and 1,000 sites have Tavern post embedded, and those 1,000 sites get 10,000 visitors per day..

Maybe the sandboxed mode stops this. I'm just trying to make sites and blog, not sure I'll ever know enough php and enough about WP to really know how it all works.

random thoughts - Sorry Jeff - I think about WP too much. If I should of divided this comment - grr. I don't know.