title: Exposing a web service through WordPress
body: <p>I'm creating a new plugin for WordPress that requires an outside website to use a web service. For instance, if there are two sites, A and B, the plugin will be installed on A with all associated data stored in the WordPress database for Site A. Site B will use the web service to grab data in XML format from Site A.</p>
  <p>Is this possible? What would be the most secure way of pulling this off?</p>
  <p>I could just have the web service as a PHP file in my plugin, but that's going to require the outside domain to hit something like:
  <a href="http://www.example.com/wp-content/plugins/plugin-folder/web-service.php" rel="nofollow noreferrer">http://www.example.com/wp-content/plugins/plugin-folder/web-service.php</a>.  It seems like a bad idea to expose the level of depth of the WordPress setup.</p>
  <p>I could have my plugin create a few files in the root so that the web service call would be to <a href="http://www.example.com/web-service.php" rel="nofollow noreferrer">http://www.example.com/web-service.php</a>, but having my plugin install stuff outside of the plugin directory also seems like a bad practice.</p>
  <p>Another thought: Could I put the file in my plugin folder, but add a line in file <em><a href="https://en.wikipedia.org/wiki/.htaccess" rel="nofollow noreferrer">.htaccess</a></em> to make <a href="http://www.example.com/web-service.php" rel="nofollow noreferrer">http://www.example.com/web-service.php</a> go to it?</p>
  <p>What is the best, most secure way to go about this?</p>