ServerKit

admin/ServerKit

0 Fork 0

mirror of https://github.com/jhd3197/ServerKit.git synced 2026-11-09 05:24:49 +09:00

Files

T

History

Juan DenisandClaude Opus 4.8 5e2d4afbda feat(wordpress): per-site security depth — integrity, debug, WP-Cron (#30 )

A per-site Security tab (Docker-correct, all via the WP-CLI bridge):

- File integrity: a background wp core verify-checksums + wp plugin
  verify-checksums --all (in-container, reaches the volume; off the request
  thread, UI polls) flagging tampered/unexpected files.
- Debug toggle: WP_DEBUG/SCRIPT_DEBUG with WP_DEBUG_DISPLAY=false and
  WP_DEBUG_LOG=/tmp/wp-debug.log — OUTSIDE the web root, so the log is never
  publicly fetchable (the default wp-content/debug.log is apache-served, a real
  info leak this avoids). The write is gated so a read-only/stopped site reports
  an honest failure.
- WP-Cron: DISABLE_WP_CRON status + due-event list, run-due-now, enable/disable
  (with a clear "needs a real system cron" warning).

Routes mirror the per-site pattern (owner-or-admin GET, @admin_required
mutations). Deferred: the brute-force wp-login/xmlrpc rate-limit jail —
Fail2ban/nginx limit_req both need a host-side per-site access log the
localhost:PORT apache-container model does not expose (same gap as #21/#25).

Verified: backend py_compile, frontend lint + build, focused security review
(debug-log web-exposure caught + fixed). Not runtime-exercised on a real host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-01 01:57:43 -04:00