I did mention another common way to prevent this is to have a content staging site, where all your content is edited; this should ideally be _completely_ separate from the public site. When content is published, it&#x27;s published to the main site from the staging site.<p>But in this case, the post seems to be unpublished (&quot;accessible only to logged-in users with the proper credentials&quot;), but the SEO redirect plugin the blog is using is likely hitting it&#x27;s 302 redirect prior to Wordpress checking it&#x27;s access on the post ID in question, leading to this URL information disclosure.