Security overview

WP Octo is a control plane for sites that belong to its customers' customers. Every design decision in this section follows from that: a mistake here is not a bug in a dashboard, it is a stranger inside someone's site.

The short version

• One workspace never sees another. Tenant isolation is a property of the product, not a setting — Tenant isolation.
• Two credentials, kept apart. An API key opens the platform's API; a workspace token opens the worker on a site. Neither belongs where the other does — Credentials.
• A site trusts one thing — its workspace token — and refuses everything else — What the plugin stores and trusts.
• The platform trusts nothing it did not verify. A firewall's page is not the site; an update the site reports as done is checked on the site before it is called done; a site is only trusted with a credential after it has refused a wrong one.
• Secrets are encrypted at rest and never shown, logged or exported. Where a person needs to recognise one, they see a fingerprint.
• A site never holds a storage credential. Backups reach object storage through links the platform hands the site for one file and a limited time.
• One operation at a time on a site. A backup, a restore, an update round and a worker update never run on the same site at once, so a restore cannot overwrite what a backup is reading.

What is not checked

Where WP Octo has no check for a class of problem, the documentation says so rather than implying one:

• A publicly readable log or debug file on a managed site. WP Octo does not look for this, and the site's Security page in the dashboard is a placeholder — Pages not yet available.
• The contents of a site's plugins and themes for vulnerabilities. The platform reports versions and available updates; it does not scan code.
• Threats and firewalls. The dashboard's security card shows the one signal the platform collects across the fleet, the state of every site's TLS certificate, and nothing more.

What this section does not do

It does not describe the platform's own infrastructure. Those are operational details and are kept out of public documentation on purpose.