从代码来看，您的警告似乎是因为执行重定向太晚了。根据经验，重定向应该在初始化操作之后进行。在重定向之后，你应该死（）wp_redirect 为您而做）

至于安全性，仅仅检查用户是否登录是不够的，您需要检查他是否有能力编辑帖子，比如if current_user_can(\'edit_post\',$post_id). 您需要在UI端和服务器端都进行检查。仅仅因为你没有向黑客展示这种能力，并不意味着如果你在服务器端没有保护，他就不会构造一个特殊的HTTP请求来更改帖子。

经过一些学习和研究，我放弃了问题中描述的方法，事实上，我找到了如何使用@TheDeadMedic添加前端编辑功能的方法solution. 现在I have only two little questions:

1） 有没有更好的方法来使用/设置帖子ID和发布日期？我使用了两个隐藏输入：foo_id 和foo_date.

2） 表单之间的通信有多安全？

这是将帖子ID获取到“postid”变量并将其传递到“post form”页面的表单：

<form action="<?php echo home_url( \'/post-form\'); ?>" method="post">
    <input type="hidden" name="postid" value="<?php the_ID(); ?>" /> 
    <input type="submit"  value="Edit" />
</form>

<?php

class WPSE_Submit_From_Front {
    const NONCE_VALUE = \'front_end_new_post\';
    const NONCE_FIELD = \'fenp_nonce\';

    protected $pluginPath;
    protected $pluginUrl;
    protected $errors = array();
    protected $data = array();

    function __construct() {
        $this->pluginPath = plugin_dir_path( __file__ );
        $this->pluginUrl  = plugins_url( \'\', __file__ );

        add_action( \'wp_enqueue_scripts\', array( $this, \'addStyles\' ) );
        add_shortcode( \'post_from_front\', array( $this, \'shortcode\' ) );

        // Listen for the form submit & process before headers output
        add_action( \'template_redirect\',  array( $this, \'handleForm\' ) );
    }

    function addStyles() {
        wp_enqueue_style( \'submitform-style\', "$this->pluginUrl/submitfromfront.css" );
    }

    /**
     * Shortcodes should return data, NOT echo it.
     *
     * @return string
     */
    function shortcode() {
        if ( ! current_user_can( \'publish_posts\' ) )
            return sprintf( \'<p>Please <a href="%s">login</a> to post links.</p>\', esc_url( wp_login_url(  get_permalink() ) ) );
        elseif ( $this->isFormSuccess() )
            return \'<p class="success">Nice one, post created.</p>\';
        else
            return $this->getForm();
    }

    /**
     * Process the form and redirect if sucessful.
     */
    function handleForm() {
        if ( ! $this->isFormSubmitted() )
            return false;

        // http://php.net/manual/en/function.filter-input-array.php
        $data = filter_input_array( INPUT_POST, array(
            // MY CODE
            \'foo_id\'      => FILTER_DEFAULT,
            \'foo_date\'    => FILTER_DEFAULT,
            // END MY CODE
            \'postTitle\'   => FILTER_DEFAULT,
            \'postContent\' => FILTER_DEFAULT,
            \'location2\'   => FILTER_DEFAULT,
        ));

        $data = wp_unslash( $data );
        $data = array_map( \'trim\', $data );

        // You might also want to more aggressively sanitize these fields
        // By default WordPress will handle it pretty well, based on the current user\'s "unfiltered_html" capability

        $data[\'postTitle\']   = sanitize_text_field( $data[\'postTitle\'] );
        $data[\'postContent\'] = wp_check_invalid_utf8( $data[\'postContent\'] );
        $data[\'location2\']   = sanitize_text_field( $data[\'location2\'] );

        $this->data = $data;

        if ( ! $this->isNonceValid() )
            $this->errors[] = \'Security check failed, please try again.\';

        if ( ! $data[\'postTitle\'] )
            $this->errors[] = \'Please enter a title.\';

        if ( ! $data[\'postContent\'] )
            $this->errors[] = \'Please enter the content.\';

        if ( ! $this->errors ) {
            $post_id = wp_insert_post( array(
                // MY CODE
                \'ID\'           => $data[\'foo_id\'],
                \'post_date\'    => $data[\'foo_date\'],
                // END MY CODE
                \'post_title\'   => $data[\'postTitle\'],
                \'post_content\' => $data[\'postContent\'],
                \'post_status\'  => \'publish\',
            ));

            if ( $post_id ) {
                add_post_meta( $post_id, \'location2\', $data[\'location2\'] );

                // Redirect to avoid duplicate form submissions
                wp_redirect( add_query_arg( \'success\', \'true\' ) );
                exit;

            } else {
                $this->errors[] = \'Whoops, please try again.\';
            }
        }
    }

    /**
     * Use output buffering to *return* the form HTML, not echo it.
     *
     * @return string
     */
    function getForm() {

    // MY CODE
    if( \'POST\' == $_SERVER[\'REQUEST_METHOD\'] && isset( $_POST[\'postid\'] ) ) {
        $post_to_edit                   = array();
        $post_to_edit                   = get_post( $_POST[\'postid\'] );
        $this->data[\'foo_id\']           = $post_to_edit->ID;
        $this->data[\'foo_date\']         = $post_to_edit->post_date;
        $this->data[\'item_name\']        = $post_to_edit->post_title;
        $this->data[\'item_description\'] = $post_to_edit->post_content;
    }
    // END MY CODE

        ob_start();
        ?>

<div id ="frontpostform">
    <?php foreach ( $this->errors as $error ) : ?>

        <p class="error"><?php echo $error ?></p>

    <?php endforeach ?>

    <form id="formpost" method="post">
        <fieldset>
            <label for="postTitle">Post Title</label>
            <input type="text" name="postTitle" id="postTitle" value="<?php

                // "Sticky" field, will keep value from last POST if there were errors
                if ( isset( $this->data[\'postTitle\'] ) )
                    echo esc_attr( $this->data[\'postTitle\'] );

            ?>" />
        </fieldset>

        <fieldset>
            <label for="postContent">Content</label>
            <textarea name="postContent" id="postContent" rows="10" cols="35" ><?php

                if ( isset( $this->data[\'postContent\'] ) )
                    echo esc_textarea( $this->data[\'postContent\'] );

            ?></textarea>
        </fieldset>

        <fieldset>
        <label for="location2">Location 2</label>
        <input type="text" name="location2" id="location2" title="Location 2 (opțional)" value="<?php

            // "Sticky" field, will keep value from last POST if there were errors
            if ( isset( $this->data[\'location2\'] ) )
                echo esc_attr( $this->data[\'location2\'] );

        ?>" />
        </fieldset>

        <fieldset>
            // MY CODE
            <input type="hidden" name="foo_id" id="foo_id" value="<?php

            // "Sticky" field, will keep value from last POST if there were errors
            if ( isset( $this->data[\'foo_id\'] ) )
                echo esc_attr( $this->data[\'foo_id\'] );

        ?>" />

            <input type="hidden" name="foo_date" id="foo_date" value="<?php

            // "Sticky" field, will keep value from last POST if there were errors
            if ( isset( $this->data[\'foo_date\'] ) )
                echo esc_attr( $this->data[\'foo_date\'] );

        ?>" />
            // END MY CODE
            <button type="submit" name="submitForm" >Create Post</button>
        </fieldset>

        <?php wp_nonce_field( self::NONCE_VALUE , self::NONCE_FIELD ) ?>
    </form>
</div>

        <?php
        return ob_get_clean();
    }

    /**
     * Has the form been submitted?
     *
     * @return bool
     */
    function isFormSubmitted() {
        return isset( $_POST[\'submitForm\'] );
    }

    /**
     * Has the form been successfully processed?
     *
     * @return bool
     */
    function isFormSuccess() {
        return filter_input( INPUT_GET, \'success\' ) === \'true\';
    }

    /**
     * Is the nonce field valid?
     *
     * @return bool
     */
    function isNonceValid() {
        return isset( $_POST[ self::NONCE_FIELD ] ) && wp_verify_nonce( $_POST[ self::NONCE_FIELD ], self::NONCE_VALUE );
    }
}

new WPSE_Submit_From_Front;