Welcome to the NZRT Wiki Podcast. Today we’re looking at Security Overview.

The NZRT WordPress site has a clear security focus — protecting user data, preventing unauthorised access, and keeping plugins and themes in good shape. The way this is structured, there are five distinct layers of security, and understanding each one helps you see how the whole system fits together.

Let’s start with Layer 1, which is Network security. All admin operations go through a VPN — specifically Tailscale — so you’re not exposing admin traffic to the open internet. The WordPress REST API is HTTPS only, meaning any plain HTTP requests get rejected at the server level. Production server access happens over a secure WebDAV connection.

Moving to Layer 2, Authentication. Each agent on the system has their own unique WordPress Application Password. There are no shared admin credentials — that’s an important point. If one password is compromised, it doesn’t take down the whole system. The main xc admin account also uses two-factor authentication, so you’d use an authenticator app like Google Authenticator or Authy when logging in. All application passwords should be rotated every quarter.

Layer 3 is Authorisation — basically, who can do what once they’re in. The xc account is the only Administrator, meaning it’s the only account with access to plugins, themes, and site-level configuration. The agents pam, cas, sun, ema, and dai are set to the Editor role, which means they work with content only. fin and han are Contributors — they can submit content for review but cannot publish directly. And dan has no WordPress login at all, just database access through the Tailscale VPN.

Layer 4 is Audit Logging, handled by a plugin called WP Activity Log. You can find it on wordpress.org and install it through the WordPress dashboard under Plugins, then Add New. What it does is track logins, post edits, plugin installs, settings changes, and user creation — all per agent. Logs are kept for a minimum of 90 days, and you can view them in the WordPress admin under WP Activity Log, then Audit Log.

Layer 5 covers Plugin and Infrastructure Security. The key habits here are updating plugins weekly through the WordPress dashboard, and only installing plugins from wordpress.org or a trusted vendor — always verify the origin before you install anything. On the infrastructure side, there’s a Web Application Firewall called ModSecurity available in cPanel, and it should be enabled if your hosting environment supports it. SSL certificate renewal is handled through cPanel’s AutoSSL feature, and you should verify it’s active.

Now let’s look at the Access Control Matrix. This is a table in the wiki that maps out four resources, who can access them, and how. The WordPress admin panel is xc only, via HTTPS with two-factor authentication. The REST API, used by agents, is accessed per agent using HTTPS plus an Application Password. The database through phpMyAdmin is dan only, via Tailscale and cPanel credentials. And cPanel itself is xc only, through Tailscale with a time-based one-time password for two-factor authentication.

If you’re setting this up fresh, there’s a priority order of five immediate actions to work through. First, enable two-factor authentication on the xc WordPress account. Second, create per-agent Application Passwords and revoke any shared admin credentials that might already exist. Third, install the WP Activity Log plugin. Fourth, verify that AutoSSL is active in cPanel. And fifth, go into WordPress Settings, then General, and confirm the Site Address is set to HTTPS.

On Plugin Security more broadly — beyond keeping things updated weekly, you should remove any plugins you’re not actively using, because every unused plugin is extra attack surface. The two plugins flagged as priority updates are WP-Script Core and SmartSlider3 Pro, the latter because it has a REST API surface that’s worth keeping patched.

If you want to go deeper, the wiki links this topic to three related notes: Backup Strategy, Updates and Maintenance, and the Virtual Agents System, which has the full role table for all agents.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.