fix: harden WordPress against WPScan findings

docs/adr/0001-wordpress-single-page.md

@@ -12,7 +12,7 @@ architecture and starts independently from `main`.
 
 ## Decision
 
-Use pinned WordPress 7.0/PHP 8.3 with MariaDB 11.8 LTS. Build a dependency-free custom
+Use pinned WordPress 7.0.2/PHP 8.3 with MariaDB 11.8 LTS. Build a dependency-free custom
 classic theme for exact semantic markup and responsive design. Store homepage fields as
 sanitized theme modifications, while a must-use plugin owns Shows and Gallery custom
 post types so structured content is not lost when changing themes.

docs/architecture.md

@@ -1,7 +1,7 @@
 # Architecture
 
 NGINX is the only public entry point for `azionelab.org`. It proxies HTTP to the
-official WordPress 7.0/PHP 8.3 Apache image over the private `web` network. WordPress
+official WordPress 7.0.2/PHP 8.3 Apache image over the private `web` network. WordPress
 connects to MariaDB 11.8 LTS over a separate internal `data` network. Neither WordPress
 nor MariaDB publishes a host port; automated security checks guard this assumption.
 

docs/operations.md

@@ -23,6 +23,11 @@ Review security releases routinely, update pins in a task branch, rebuild, run t
 test suite, and deploy. Production disables WordPress web-based file modifications, so
 image rebuilds are the update path.
 
+External `wp-cron.php` requests are blocked to reduce public attack surface. If future
+content scheduling, maintenance jobs, or plugin features require WordPress cron, run it
+from a controlled host/container cron against the private WordPress service instead of
+leaving the public trigger enabled.
+
 ## Backup and restore
 
 Create database and WordPress file backups in one maintenance window. The default host
@@ -42,6 +47,8 @@ the database and file volume together, restart, and verify the homepage, media,
   owner or mode; run `./scripts/prepare-host-volumes.sh` after changing paths or image
   user IDs.
 - SMTP is not configured; WordPress password-reset email needs an external mail service.
+- WordPress cron is not publicly triggerable; scheduled jobs need an operator-managed
+  cron runner if that feature becomes necessary.
 - Admin MFA and network allowlisting are deployment concerns and are not bundled.
 - WordPress plugins expand the attack surface; install only reviewed, maintained,
   necessary plugins.

docs/security.md

@@ -12,9 +12,11 @@
 - File editing is always disabled. Production also disables web-based core, theme, and
   plugin changes; patched images are rebuilt and redeployed instead.
 - XML-RPC and comments are disabled. NGINX blocks PHP execution below uploads, dotfiles,
-  and direct `wp-config.php` requests, and rate-limits login/public requests. Apache
-  also denies uploaded PHP files and direct access to sensitive WordPress internals as
-  defense in depth. Public REST user enumeration and author archives are disabled.
+  direct `wp-config.php` requests, the WordPress readme/license files, direct
+  installation entry points, public mu-plugin directory probing, and external
+  `wp-cron.php` requests. It also rate-limits login/public requests. Apache also denies
+  uploaded PHP files and direct access to sensitive WordPress internals as defense in
+  depth. Public REST user enumeration and author archives are disabled.
 - Security headers include CSP, same-origin framing, content-type protection, a strict
   referrer policy, and a restrictive Permissions Policy. WordPress compatibility still
   requires inline style/script CSP allowances; do not treat this CSP as an XSS sanitizer.