Invalid Feed Token Security Alerts
Benecaster monitors failed feed token attempts on each of your shows. When the number of failures crosses a threshold in a short window, a security notice appears in your Benecaster notification center. This page explains what the alert means and what to do about it.
What the Alert Means
A failed token attempt happens when a podcast app — or anything else — presents a feed URL that Benecaster does not recognize as valid. Common reasons:
- A subscriber is using an old feed URL after their token was reset
- A subscriber whose access was revoked is still trying to use their old URL
- The feed URL was shared with someone who is not a subscriber
- An automated bot or scraper is probing feed URLs on your site
A small number of failures is normal. The alert only fires when failures for a single show spike above a threshold in a short period, which suggests something beyond a routine misconfiguration.
Investigating the Alert
Go to Benecaster → Subscribers → Feed Request Log and filter by Status: Invalid token. Look for patterns:
| Pattern | What it suggests |
|---|---|
| Many attempts from a single IP address | A bot, scraper, or a subscriber whose app is retrying aggressively |
| Attempts from many different IP addresses | The feed URL may have been shared or posted publicly |
| A single attempt from an IP you recognize | Likely a subscriber using an old URL after a reset — probably no action needed |
| Attempts clustered around when you revoked a subscriber | The revoked subscriber’s app is still trying the old URL |
What to Do
If it looks like a revoked or reset subscriber: No action needed on the token — it is already invalid. If the subscriber is contacting you, point them to their new feed URL or confirm their access has ended.
If it looks like a shared URL: Identify the subscriber whose token is being used and reset their token. This invalidates the old URL for everyone using it and generates a new private URL for the subscriber. Let the subscriber know their feed URL has changed and they will need to re-add it in their podcast app.
If it looks like a bot or scraper: The attempts are hitting an invalid token, so no subscriber data is exposed. The requests return a 401 or 404 and no content is served. You can block the IP address at your hosting or CDN level if the volume is causing performance concerns. There is no Benecaster-level block list for feed requests.
If you are not sure: Contact support with the time range and show name. We can review the request log and help determine the cause.
Adjusting the Alert Threshold
The default threshold is 10 invalid attempts within a 60-minute window per show. Developers can adjust this using the benecaster_invalid_token_alert_threshold filter:
add_filter( 'benecaster_invalid_token_alert_threshold', function( array $threshold ): array {
// Raise the threshold for a high-traffic show.
$threshold['count'] = 25;
$threshold['window_minutes'] = 60;
return $threshold;
} );
Return null or false to disable the alert entirely.
What Is Not a Security Risk
Invalid token attempts do not expose subscriber data. A request with an invalid token is rejected before any feed content or subscriber information is returned. The alert is informational — it tells you something unusual is happening, not that a breach has occurred.