SecOps Stack for WordPress

What it adds

Compared with a default installation of the same software.

• Web application firewall on from the first boot.
• Encrypted web access from the first boot, with automatic certificates once a domain is set.
• No shared or default passwords; credentials are generated for each instance.
• Administrator access with your own key pair only.
• A host firewall that allows only what the image needs.
• Security updates applied automatically.
• Repeated failed logins are blocked automatically.
• Administrator commands are logged.
• Released without leftover keys, credentials or shell history.
• Every release passes automated boot and security tests.

What you can and cannot do

Choices made on purpose for security, so you know them before you launch.

• Plugins and themes are installed by an administrator over SSH, not from the browser.
• The browser installer, updater and file editor are turned off, so a flaw in a plugin cannot change the site's code.
• The application itself is updated by replacing the instance with a newer image; your data volume is kept.
• Files uploaded through the site are stored as data and can never run as code.
• Plugins and themes you add are not covered by the image's tests or vulnerability scan; keeping them current is up to you.

Launch

Opens the AWS console in your own account, with the image already chosen. Pick a Graviton (arm64) instance type such as t4g.