fix: harden WordPress against WPScan findings

docs/operations.md

@@ -23,6 +23,11 @@ Review security releases routinely, update pins in a task branch, rebuild, run t
 test suite, and deploy. Production disables WordPress web-based file modifications, so
 image rebuilds are the update path.
 
+External `wp-cron.php` requests are blocked to reduce public attack surface. If future
+content scheduling, maintenance jobs, or plugin features require WordPress cron, run it
+from a controlled host/container cron against the private WordPress service instead of
+leaving the public trigger enabled.
+
 ## Backup and restore
 
 Create database and WordPress file backups in one maintenance window. The default host
@@ -42,6 +47,8 @@ the database and file volume together, restart, and verify the homepage, media,
   owner or mode; run `./scripts/prepare-host-volumes.sh` after changing paths or image
   user IDs.
 - SMTP is not configured; WordPress password-reset email needs an external mail service.
+- WordPress cron is not publicly triggerable; scheduled jobs need an operator-managed
+  cron runner if that feature becomes necessary.
 - Admin MFA and network allowlisting are deployment concerns and are not bundled.
 - WordPress plugins expand the attack surface; install only reviewed, maintained,
   necessary plugins.