Security
A content management system is as secure as the speed at which a fix reaches the sites. So phpRS focuses mainly on this: that the fix arrives by itself, and that nobody else can arrive in its place.
Reporting a vulnerability
Please do not report security vulnerabilities publicly. Use private reporting on GitHub (Security → Report a vulnerability in the project repository) or e-mail info@phprs.eu.
Include the phpRS version, the steps to reproduce and the impact. We reply within three working days. We usually release a fix within 14 days, and as soon as possible for critical vulnerabilities. After the release we publish a security advisory with thanks to the reporter.
What happens next
- The fix comes out as a security release.
- Sites with automatic updates switched on install it themselves within 12 hours – after a database backup and signature verification.
- The administrator gets an e-mail. Those who have automatic updates switched off see a notice and update with one button.
Signed updates
The administration installs only a package that was verifiably released by the publisher of phpRS.
- Ed25519 signature
- The version, the package checksum and the “security” flag are all signed. Nobody along the way can turn an ordinary release into one that installs itself.
- The key is not on a server
- The private key never leaves the publisher's computer. Compromising the phprs.eu website or GitHub is not enough to forge an update.
- Backup key
- The system knows two public keys. The second is stored offline and is used to replace the first one safely.
- Integrity check
- Every release carries a signed list of core files. System status uses it to report changed, missing and added files.
Default settings
Secure behaviour is not an option in the settings. It is on from the moment of installation.
- Two-factor login
- TOTP with backup codes. System status points out any administrator who does not have it.
- Protection against password guessing
- A temporary account lock and a limit per IP address – for the editorial team and for readers.
- Content Security Policy
- The administration runs no inline and no third-party scripts.
- Uploaded files are not executed
- PHP does not run in the media folder, and only safe file types are allowed.
- No third-party plug-ins
- The most common way content management systems get compromised does not exist in phpRS.
- Boundaries for AI
- The connection to Claude works with content and custom templates. It has no access to the code, the users or the server.
Security in the documentation: what to do after installation