Security Documentation

Overview

Wp Admin's security suite provides multi-layered protection for your WordPress websites. Our approach follows the defense-in-depth strategy, implementing security controls at every level — from the network perimeter down to individual file permissions.

Security Model

Our security model is built on three pillars:

Firewall Configuration

Wp Admin implements a Web Application Firewall (WAF) specifically tuned for WordPress. The firewall operates at Layer 7 and filters incoming traffic using a combination of rule-based filtering and machine learning models.

Firewall Rules

The firewall automatically applies the following protection rules:

Custom Rules

You can define custom firewall rules using our configuration API. Rules are applied using a priority-based system:

{
  "firewall_rules": {
    "enabled": true,
    "mode": "strict",
    "custom_rules": [
      {
        "id": "block-suspicious-ua",
        "action": "block",
        "priority": 100,
        "conditions": {
          "user_agent": { "contains": ["scanner", "exploit"] }
        }
      },
      {
        "id": "rate-limit-api",
        "action": "throttle",
        "priority": 200,
        "conditions": {
          "path": "/wp-json/*",
          "rate_limit": "30/min"
        }
      }
    ],
    "whitelist_ips": ["203.0.113.0/24", "198.51.100.10"]
  }
}

Malware Scanning

Wp Admin performs automated malware scans on a configurable schedule. Scanning covers all WordPress core files, themes, plugins, and uploaded media files.

Scan Types

Scan Configuration

# wpadmin-security.yml
malware_scanning:
  schedule: "0 */6 * * *"  # Every 6 hours
  scan_type: "full"       # full | quick | scheduled
  auto_cleanup: false     # Never auto-delete without approval
  exclusions:
    paths: ["/wp-content/uploads/bundles/"]
    extensions: [".psd", ".ai"]
  notifications:
    on_threat_found: ["email", "webhook", "slack"]
    on_scan_complete: "email"
    report_recipients: ["admin@yourdomain.com"]

Authentication

Strong authentication is the first line of defense. Wp Admin enforces security best practices for all WordPress login mechanisms.

Enforced Policies

• Password Strength: Enforced minimum of 12 characters with complexity requirements (uppercase, lowercase, numbers, symbols)
• Two-Factor Authentication (2FA): Mandatory 2FA for all administrator accounts using TOTP (Time-based One-Time Password)
• Login Attempts: Maximum 5 failed attempts before 30-minute lockout with exponential backoff
• Session Management: Sessions expire after 24 hours of inactivity; concurrent sessions limited to 3 per user
• XML-RPC: Disabled by default unless explicitly required by your site's functionality
• Admin URL: Customizable login URL to prevent automated discovery attacks

2FA Setup

// Enable 2FA via Wp Admin API
const response = await fetch("https://api.wpadmin.com/v3/auth/2fa/enable", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${WP_ADMIN_TOKEN}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    site_id: "site_abc123",
    method: "totp",
    enforce_roles: ["administrator", "editor"],
    backup_codes_count: 10,
    grace_period: 15  // minutes without 2FA enforcement
  })
});

const data = await response.json();
// Returns QR code URL and secret key
console.log(data.qr_code_url);

SSL / HTTPS

All managed sites are served over HTTPS. Wp Admin handles SSL certificate provisioning, renewal, and configuration automatically.

SSL Features

Hardening

Wp Admin applies industry-standard WordPress hardening techniques automatically upon onboarding and maintains them continuously.

Automatic Hardening Actions

Compliance

Wp Admin helps you maintain compliance with industry security standards and regulations applicable to your website.

Supported Standards

• OWASP Top 10: All OWASP vulnerabilities addressed through firewall rules and hardening
• GDPR: Cookie consent management, data export/erasure endpoints, privacy policy templates
• PCI DSS: Network security requirements for e-commerce sites handling payment data
• HIPAA: Audit logging, access controls, and encryption for healthcare-related WordPress sites (Enterprise only)
• SOC 2 Type II: Wp Admin is SOC 2 Type II certified — audit reports available upon request

API Endpoints

Manage security settings programmatically using our REST API. All security endpoints require the security:admin scope.

Example: Triggering a Scan

curl -X POST https://api.wpadmin.com/v3/security/scan \n  -H "Authorization: Bearer wp_live_sk_abc123..." \n  -H "Content-Type: application/json" \n  -d '{
    "site_id": "site_xyz789",
    "scan_type": "full",
    "notify": true
  }'

// Response:
// {
//   "scan_id": "scan_9a8b7c",
//   "status": "queued",
//   "estimated_duration": "15-30 minutes",
//   "created_at": "2025-01-15T10:30:00Z"
// }

Security Checklist

Use this checklist to ensure your WordPress site meets our recommended security baseline. Items marked with ✓ are automatically handled by Wp Admin.