WordPress: scheme in wordpress__url, hardening, read-only core, and a setup_wordpress scenario - #382

Merged

NavidSassan merged 25 commits into

mainfrom

feat/wordpress-url-scheme

Sep 16, 2026

Commits on Sep 15, 2026

feat(roles/wordpress)!: include the scheme in wordpress__url
NavidSassan
committed
90b2a4c
fix(roles/apache_httpd): let the WordPress wp-includes rules match in vHost context
NavidSassan
committed
64d32bb
fix(roles/apache_httpd): refuse to run PHP from wp-content/uploads
NavidSassan
committed
4546f40
feat(roles/apache_httpd): send Referrer-Policy and nosniff from the WordPress vHost
NavidSassan
committed
aa520e5
fix(roles/wordpress): make wp-config.php unreadable for other local users
NavidSassan
committed
34f4e0d
fix(roles/wordpress)!: trust X-Forwarded-For only from wordpress__trusted_proxies
NavidSassan
committed
08d1ce2
feat(roles/fail2ban): add a wordpress-login filter and jail
NavidSassan
committed
1c71bd8
fix(roles/wordpress): verify the WP-CLI download against its checksum
NavidSassan
committed
3db01bb
fix(roles/wordpress): pass the passwords to WP-CLI on stdin
NavidSassan
committed
6259916
fix(roles/wordpress): write exports to a private directory
NavidSassan
committed
7aefe4b
feat(roles/wordpress)!: switch application passwords off by default
NavidSassan
committed
b460c60
fix(roles/wordpress): create the apache remote_tmp without trailing spaces
NavidSassan
committed
90f9038
fix(roles/wordpress): import wordpress__wxr_export when installing WordPress
NavidSassan
committed
dc558db
fix(roles/wordpress): run WP-CLI as apache and report only real changes
NavidSassan
committed
10e1800
test(extensions/molecule): add the setup_wordpress scenario
NavidSassan
committed
63ea736
test(extensions/molecule): check the wordpress-login filter in the fail2ban scenario
NavidSassan
committed
56c3ead
docs(COMPATIBILITY): mark wordpress as tested on RHEL 9 and 10
NavidSassan
committed
2fe7c6e
feat(roles/wordpress)!: replace disable-json-api with Disable WP REST API
NavidSassan
committed
b1709d9
feat(roles/wordpress)!: keep the core read-only for the web server
NavidSassan
committed
1a51f8e

Navigation Menu

Uh oh!

WordPress: scheme in wordpress__url, hardening, read-only core, and a setup_wordpress scenario - #382

WordPress: scheme in wordpress__url, hardening, read-only core, and a setup_wordpress scenario#382
NavidSassan merged 25 commits into
mainfrom
feat/wordpress-url-scheme

Commits on Sep 15, 2026

feat(roles/wordpress)!: include the scheme in wordpress__url

fix(roles/apache_httpd): let the WordPress wp-includes rules match in vHost context

fix(roles/apache_httpd): refuse to run PHP from wp-content/uploads

feat(roles/apache_httpd): send Referrer-Policy and nosniff from the WordPress vHost

fix(roles/wordpress): make wp-config.php unreadable for other local users

fix(roles/wordpress)!: trust X-Forwarded-For only from wordpress__trusted_proxies

feat(roles/fail2ban): add a wordpress-login filter and jail

fix(roles/wordpress): verify the WP-CLI download against its checksum

fix(roles/wordpress): pass the passwords to WP-CLI on stdin

fix(roles/wordpress): write exports to a private directory

feat(roles/wordpress)!: switch application passwords off by default

fix(roles/wordpress): create the apache remote_tmp without trailing spaces

fix(roles/wordpress): import wordpress__wxr_export when installing WordPress

fix(roles/wordpress): run WP-CLI as apache and report only real changes

test(extensions/molecule): add the setup_wordpress scenario

test(extensions/molecule): check the wordpress-login filter in the fail2ban scenario

docs(COMPATIBILITY): mark wordpress as tested on RHEL 9 and 10

feat(roles/wordpress)!: replace disable-json-api with Disable WP REST API

feat(roles/wordpress)!: keep the core read-only for the web server

Commits on Sep 16, 2026

feat(roles/wordpress): allow several instances per host as pseudo hosts

refactor(roles/wordpress): follow CONTRIBUTING and leave the old vHost file to the operator

feat(roles/wordpress): allow several instances under sub-paths of one host name

feat(roles/wordpress): reload PHP-FPM after core updates

docs(roles/wordpress): document plugin auto-updates and FallbackResource as manual steps

Merge branch 'main' into feat/wordpress-url-scheme