# Security

- NGINX is the only published service. MariaDB is restricted to an internal network;
  WordPress is reachable only from NGINX and the database network.
- Production startup rejects placeholder or short database passwords. `.env` is
  ignored and real secrets must come from the deployment secret manager.
- WordPress uses its normal capability, nonce, authentication, cookie, and password
  controls. Theme settings sanitize input and templates escape output.
- File editing is always disabled. Production also disables web-based core, theme, and
  plugin changes; patched images are rebuilt and redeployed instead.
- XML-RPC and comments are disabled. NGINX blocks PHP execution below uploads, dotfiles,
  and direct `wp-config.php` requests, and rate-limits login/public requests. Public
  REST user enumeration and author archives are disabled.
- Security headers include CSP, same-origin framing, content-type protection, a strict
  referrer policy, and a restrictive Permissions Policy. WordPress compatibility still
  requires inline style/script CSP allowances; do not treat this CSP as an XSS sanitizer.
- Forwarded client/protocol headers are overwritten by default. Trust mode is permitted
  only behind a restricted load balancer that overwrites those headers.
- Direct TLS is fail-closed until a certificate exists. Certbot has a read-only root,
  no Docker socket, dropped capabilities, and narrowly scoped volumes.
- Containers are not privileged and do not use host networking or the Docker socket.
  WordPress/Apache retains the capabilities needed by the official image internally,
  but no WordPress port is published.
- WordPress/Apache access logs are disabled to avoid duplicate client metadata and
  healthcheck noise; NGINX remains the single request log and PHP warnings/errors stay
  visible.
- Admin MFA, an IP/VPN allowlist, SMTP, malware scanning, log aggregation, and a secret
  manager remain production operator responsibilities.
- Backups and uploads can contain personal data. Encrypt, restrict, retain, and delete
  them according to the applicable privacy policy.

See [ADR-0001](adr/0001-wordpress-single-page.md).