Security

Security Overview

The Remote Sites feature implements multiple layers of security to protect your WordPress installations and credentials. This document outlines security measures, best practices, and recommendations.

Authentication Security

Application Passwords

WordPress Application Passwords:

• Uses WordPress native Application Passwords feature
• Not regular user passwords
• Scoped to specific application
• Can be revoked individually

Benefits:

• More secure than regular passwords
• Can revoke without changing password
• Per-application isolation
• Audit trail available

Best Practices:

• Generate unique passwords per site
• Use descriptive names
• Revoke unused passwords
• Regular rotation recommended

Basic Authentication

HTTP Basic Auth:

• Username:password encoded in Base64
• Sent in Authorization header
• Standard HTTP authentication
• Supported by WordPress REST API

Security Considerations:

• Always use HTTPS
• Never use HTTP
• Credentials transmitted in header
• Encrypted over HTTPS

Transmission:

• Base64 encoded (not encrypted)
• Requires HTTPS for security
• Standard protocol
• Widely supported

Capability-Based Access Control

Frontend Protection

Password Exposure Prevention:

• Passwords not sent to frontend
• Capability check before output
• Only authorized users see config
• Prevents credential exposure

Implementation:

• Checks user capability
• Filters settings output
• Removes sensitive data
• Secure by default

Default Capability:

• manage_options required
• Administrator level access
• Configurable capability
• Flexible control

Backend Protection

Settings Access:

• Capability check on save
• Validates permissions
• Prevents unauthorized changes
• Secure configuration

REST API Protection:

• Permission callbacks
• Capability checks
• Nonce verification (local)
• Basic Auth (remote)

Network Security

HTTPS Requirement

Why HTTPS:

• Encrypts credentials
• Prevents interception
• Secure transmission
• Industry standard

Implementation:

• Validates URL protocol
• Recommends HTTPS
• Warns on HTTP
• Best practice enforcement

Benefits:

• Encrypted communication
• Prevents man-in-the-middle
• Secure credential transmission
• Trusted connections

CORS Considerations

Cross-Origin Requests:

• May require CORS headers
• Depends on configuration
• Browser security feature
• Can be configured

Remote Site Configuration:

• Add CORS headers if needed
• Allow specific origins
• Secure configuration
• Test connectivity

WordPress REST API:

• Handles CORS automatically
• Configurable via filters
• Secure defaults
• Customizable

Credential Storage

Database Storage

Storage Method:

• Stored in WordPress options
• Encrypted in database
• Application passwords only
• No plain text passwords

Security Measures:

• WordPress encryption
• Database security
• Access controls
• Secure storage

Access Control:

• Only admins can access
• Capability protected
• Secure retrieval
• Limited exposure

Frontend Security

No Credential Exposure:

• Passwords never sent to frontend
• Capability check prevents output
• Secure by default
• Protection built-in

Implementation:

• Filters settings output
• Checks user capability
• Removes sensitive data
• Prevents exposure

Permission System

Unified Permission Checker

RestPermissionChecker Class:

• Consistent validation
• Local vs remote detection
• Appropriate security
• Unified system

Local Requests:

• WordPress nonce verification
• CSRF protection
• Session-based auth
• Standard WordPress

Remote Requests:

• Basic Auth validation
• Application password check
• Credential verification
• Secure authentication

Capability Requirements

Default Requirements:

• manage_options for switcher
• manage_options for settings
• Administrator level
• Secure defaults

Configurable:

• Custom capability support
• Flexible permissions
• Role-based access
• Customizable control

Best Practices

Password Management

Application Passwords:

• Generate unique passwords
• Use descriptive names
• Document purpose
• Regular rotation

Storage:

• Use password manager
• Secure storage
• Don't share passwords
• Keep private

Rotation:

• Regular updates
• Revoke old passwords
• Generate new ones
• Update configuration

Network Security

HTTPS Only:

• Always use HTTPS
• Never use HTTP
• SSL certificates required
• Secure connections

Firewall Rules:

• Restrict access if possible
• IP whitelisting
• VPN recommended
• Secure network

Network Access:

• Use VPN for remote
• Secure connections
• Monitor access
• Audit logs

Access Control

Capability Settings:

• Use restrictive capabilities
• Test with different users
• Verify permissions
• Regular audits

User Management:

• Limit admin accounts
• Regular access reviews
• Monitor usage
• Revoke unused access

Configuration Security

Settings Protection:

• Admin-only access
• Capability checks
• Secure storage
• Validation

Error Handling:

• Don't expose details
• Generic error messages
• Log errors securely
• User-friendly messages

Security Considerations

Potential Risks

Network Interception:

• Mitigated by HTTPS
• Encrypted transmission
• Secure protocols
• Best practices

Credential Exposure:

• Prevented by capability checks
• No frontend exposure
• Secure storage
• Protected access

Unauthorized Access:

• Capability protection
• Permission checks
• Access controls
• Secure defaults

Mitigation Strategies

Defense in Depth:

• Multiple security layers
• Redundant protection
• Comprehensive security
• Best practices

Regular Audits:

• Review configurations
• Check access logs
• Verify permissions
• Update passwords

Monitoring:

• Track access
• Monitor usage
• Review logs
• Detect anomalies

Compliance Considerations

GDPR Compliance

Data Protection:

• Secure credential storage
• Access controls
• Encryption
• Privacy protection

User Rights:

• Access to data
• Deletion rights
• Privacy protection
• Compliance

Security Standards

Industry Standards:

• HTTPS requirement
• Secure authentication
• Access controls
• Best practices

WordPress Standards:

• Follows WordPress practices
• Uses native features
• Secure implementation
• Standards compliant

Recommendations

For Administrators

Security Checklist:

• ✅ Use HTTPS only
• ✅ Strong application passwords
• ✅ Restrictive capabilities
• ✅ Regular password rotation
• ✅ Monitor access
• ✅ Review configurations
• ✅ Keep WordPress updated
• ✅ Use secure networks

For Developers

Implementation:

• Follow security best practices
• Use capability checks
• Validate all input
• Sanitize output
• Secure storage
• Error handling

Testing:

• Test with different users
• Verify permissions
• Check error handling
• Security testing

For End Users

Usage Guidelines:

• Use secure networks
• Don't share credentials
• Report issues
• Follow best practices
• Keep passwords secure

Security Updates

Staying Secure

Regular Updates:

• Keep WordPress updated
• Update uiXpress plugin
• Security patches
• Stay current

Monitoring:

• Review security notices
• Check for updates
• Monitor access
• Stay informed

Best Practices:

• Follow recommendations
• Implement security measures
• Regular audits
• Continuous improvement