Guides

Not necessarily.

No.

Yes.

Some clients can connect to relays through Tor when configured to use a Tor proxy or a Tor-capable environment.

Yes.

An ordinary signed event is immutable: changing its content changes its ID and requires a new signature.

You can publish a NIP-09 deletion request for your own event.

A different private key produces a different public identity under Nostr's basic key model.

A relay can reject, remove, or decline to show events on its own server.

Privacy depends on the messaging scheme and client.

A public post is signed by a stable public key, so people can link its activity over time.

Repeated authentication attempts arrive through XML-RPC on a site that exposes it. Attackers may test credentials through a second login surface.

A compromised administrator account edits executable site files from the dashboard. Malicious code can persist in a theme or plugin.

An integration accepts incoming webhook data without verifying its signature. A forged notification may trigger order or account actions.

An incoming webhook route trusts a request without authenticating its sender. External callers may trigger automation or data changes.

A custom reset flow uses predictable, reusable, or long-lived tokens. Someone who obtains or guesses a token may reset another person's password.

An installed plugin no longer receives security fixes. A known flaw can remain reachable indefinitely.

A form handler trusts a submitted request without authorizing the user. A crafted request can change settings or content.

A plugin AJAX action changes data without checking the caller's capability. An anonymous or low-privilege request may trigger the action.

A registration or import action creates accounts without the intended authorization. Attackers may create access paths or hidden administrators.