fix: harden wordpress edge exposure

docs/security.md

@@ -9,8 +9,9 @@
 - File editing is always disabled. Production also disables web-based core, theme, and
   plugin changes; patched images are rebuilt and redeployed instead.
 - XML-RPC and comments are disabled. NGINX blocks PHP execution below uploads, dotfiles,
-  and direct `wp-config.php` requests, and rate-limits login/public requests. Public
-  REST user enumeration and author archives are disabled.
+  and direct `wp-config.php` requests, and rate-limits login/public requests. Apache
+  also denies uploaded PHP files and direct access to sensitive WordPress internals as
+  defense in depth. Public REST user enumeration and author archives are disabled.
 - Security headers include CSP, same-origin framing, content-type protection, a strict
   referrer policy, and a restrictive Permissions Policy. WordPress compatibility still
   requires inline style/script CSP allowances; do not treat this CSP as an XSS sanitizer.
@@ -20,7 +21,8 @@
   no Docker socket, dropped capabilities, and narrowly scoped volumes.
 - Containers are not privileged and do not use host networking or the Docker socket.
   WordPress/Apache retains the capabilities needed by the official image internally,
-  but no WordPress port is published.
+  but no WordPress port is published. A containerized security test fails if the
+  WordPress service is configured with host-published ports.
 - Persistent state uses host-based bind mounts. Keep those paths outside the public web
   root, restrict host access, never make them world-writable, and run
   `./scripts/prepare-host-volumes.sh` when paths or image user IDs change.