Security

Security

Awthy is a security plugin, so public claims need to stay precise. The public site should explain what is shipped, what is planned, and how to report a vulnerability.

Before broad availability

• Publish a monitored responsible-disclosure contact or Patchstack mVDP link.
• Publish a privacy page covering analytics, forms, support emails, billing providers, and any plugin telemetry opt-in.
• Keep screenshots free of secrets, recovery codes, private emails, local URLs, and fake UI states.
• Avoid words like unhackable, guaranteed, or compliant unless the claim is externally verified and scoped.

Login protection guides

• Brute Force Protection covers retry limits, activity review, and recovery boundaries.
• Anomalous Logins covers login activity signals, approximate location limits, and geo setup links.
• Custom Login Path covers safe enablement, rollback, and conflict classes.
• IP Access Rules covers monitor and enforce modes, allow/block lists, and lockout recovery.
• Username Hygiene covers default username risk and safe rename expectations.
• Attack Target Reports covers failed-login target interpretation and privacy-safe support use.
• Known-threat detection covers local scans, incomplete coverage, alerts, and real-cron operation.
• Breached Passwords covers password breach checks and privacy boundaries.
• Incident Response covers admin lock, unlock, and recovery workflows.
• Geo Database covers local and Hub-managed geo database setup.

Move the encryption key to wp-config.php

Awthy needs AWTHY_ENCRYPTION_KEY before it can encrypt authenticator secrets. If activation cannot write to wp-config.php, Awthy stores a generated key in the database so setup can continue, then shows an advanced notice. That fallback works, but the strongest posture is to keep the key in wp-config.php, outside the database that holds the encrypted values.

To harden an install:

1. Copy the existing awthy_encryption_key value from the site owner-controlled backup or migration record. Do not paste it into support tickets, screenshots, logs, chat, or issue trackers.

2. Add it above the WordPress stop-editing marker in wp-config.php:

   define( 'AWTHY_ENCRYPTION_KEY', 'paste-the-existing-base64-key-here' );

3. Reload the WordPress admin and confirm the Awthy advanced key notice is gone.

4. Keep wp-config.php and server backups access-controlled. Losing this key can prevent decryption of stored authenticator secrets.

Do not generate a new key while enrolled factors already exist unless you are following an explicit Awthy key-rotation procedure. Replacing the key without rotation can make existing encrypted TOTP secrets unreadable.

Disclosure Fallback

Until Patchstack mVDP is active, use the repository-backed fallback policy in docs/marketing/responsible_disclosure_policy.md: report suspected vulnerabilities to security@awthy.com, do not send secrets or unnecessary personal data, and expect acknowledgment of credible reports within 3 business days.