External requests initiated by a WordPress server should be considered as security-sensitive. They may contain sensitive data which is stored in
the files or in the database of the server. It’s important for the administrator of a WordPress server to understand what they contain and to which
server they are sent.
WordPress makes it possible to block external requests by setting the WP_HTTP_BLOCK_EXTERNAL option to true. It’s then
possible to authorize requests to only a few servers using another option named WP_ACCESSIBLE_HOSTS.
If WP_HTTP_BLOCK_EXTERNAL is not defined or set to false, any plugin or theme installed on the WordPress server may send
requests to any server on the internet. This may lead to data leaks or Server-Side Request Forgery (SSRF) attacks.
