What it does
This page collects the security facts that matter most when you're deciding whether to trust WPClientHub with a client site.
Magic links
- Client sign-in links: 15 minutes, single-use, throttled 5 attempts per email / 20 per IP per 15 minutes, enumeration-safe (a known and an unknown email get the identical response).
- Client invitation links: 7 days, single-use.
- Team invitation links: 7 days, single-use, with a reminder email 48 hours after sending.
- Every magic link is stored hashed, never in plaintext, and is never queued for delivery — it is sent synchronously so the plaintext token never touches a queue backend.
What the connector plugin can and can't do
Pairing a site gives your WPClientHub account administrative control over that site: syncing state, running updates you trigger, taking backups, one-time single-use login, toggling maintenance mode, and — from connector version 0.5.0 — updating itself when you ask it to. It never auto-applies anything without you asking, including security releases; a security release is flagged urgent, never installed silently.
When you pair a site, WPClientHub generates a unique Ed25519 keypair for that site. The site receives and stores only the public key — the private key never leaves WPClientHub. Every request from WPClientHub to the site carries a detached Ed25519 signature over a timestamp, a random nonce, and the exact request body, verified with libsodium before anything runs; requests more than 5 minutes off, or replayed nonces, are rejected outright. For data a site pushes back (sync results, activity log entries), the site generates its own bearer secret at pairing time — WPClientHub never chooses a site's own credentials.
Your WordPress password is never seen, stored, or transmitted by WPClientHub. One-click login uses a single-use, 60-second token instead.
Backups of the hub itself
WPClientHub's own database — the one holding every managed site's public key material and account data — is backed up daily, encrypted, and shipped offsite; an hourly check independently verifies the newest backup is fresh, actually encrypted, and actually left the building, emailing a human the moment any of that stops being true.
Two-factor authentication
Any member can turn on two-factor authentication (TOTP — Google Authenticator, 1Password, Authy, any RFC 6238 app) from Settings → Security: scan a QR code, confirm the current six-digit code, and it's on. Ten single-use recovery codes are issued at that moment and shown exactly once — save them somewhere safe, since a lost phone with no saved codes means asking an owner or admin to remove and re-invite the account. Codes can be regenerated at any time, which invalidates the old set.
An owner can require two-factor authentication for everyone in the organization from the same page. Turning that on is refused unless the owner turning it on is themselves enrolled — otherwise a single-owner organization could lock out its only owner. A member caught by the requirement without two-factor on is redirected to Security to set it up on their very next request; nothing already open in their browser is interrupted or logged out.
Turning two-factor off, regenerating recovery codes, and signing out other sessions all require a fresh re-confirmation of your password (and, once enrolled, your second factor too) taken within the last ten minutes — the same "confirm it's you" prompt Laravel calls step-up re-authentication, just enforced on more than the one route it ships with by default.
Active sessions
Settings → Security also lists every browser currently signed in to your account — device/browser, IP address, and when it was last active — pulled directly from the session store, and lets you sign out every session except the one you're using right now. Changing your password does the same thing automatically: it invalidates every other session's "remember me" cookie and removes their session rows outright, so a stolen password stops being useful the moment you notice and change it.
Limits & defaults
| Setting | Default |
|---|---|
| Client magic link TTL | 15 minutes |
| Client / team invite TTL | 7 days |
| Request signature clock skew tolerance | 5 minutes |
| One-click login token | Single-use, 60 seconds |
| Hub database backup | Daily, encrypted, offsite, freshness-checked hourly |
| Two-factor recovery codes | 10, single-use, regenerate any time |
| Two-factor code window | ±30 seconds, each code usable once |
| Two-factor code attempts | 5 per minute, per account and per IP |
| "Remember this device" at login | 30 days, opt-in per device |
| Step-up re-confirmation window | 10 minutes |