Add a warning about the HMAC thingy for wordpress

1 files changed, 6 insertions, 0 deletions

diff --git a/doc/source/config.rst b/doc/source/config.rst
index 258b1ab..84e3fa9 100644
--- a/doc/source/config.rst
+++ b/doc/source/config.rst
@@ -164,6 +164,12 @@ It can either be ``enabled`` or ``disabled`` and can be used in ``simulation`` m
   sp.unserialize_hmac.enable();
   sp.unserialize_hmac.disable();
 
+
+.. warning::
+
+  This feature breaks web applications doing checks on the serialized
+  representation of data on their own, like `WordPress <https://wordpress.com/>`__.
+
 .. _config_cookie-encryption:
 
 Cookies-related mitigations