The RivoPress security model

Authentication

OAuth 2.1 with mandatory PKCE (S256), single-use authorization codes, 1-hour access tokens and 30-day refresh tokens with rotation — a reused old refresh token is rejected. Only SHA-256 hashes of tokens are stored. Manual tokens are random 64-hex secrets, stored hashed, shown once. Plain passwords are never accepted.

Authorization — two locks on every door

Scope: each token is read, editor, shop or admin; out-of-scope tools are refused at the protocol level. Capabilities: the WordPress capabilities of the token’s user always apply on top. Pro adds a per-token tool allowlist and the Approval Queue.

Verified Writes

Every mutating tool: snapshot the before-state → perform the write → re-read the object fresh → compare field by field. A mismatch produces a hard error; RivoPress never reports a success it has not seen. The newest 20 changes per user can be undone.

Deliberate absences

No raw SQL, PHP-eval, shell or arbitrary option-writing tools. Deletes move items to trash. RivoPress refuses to deactivate itself.

Data handling

Fully self-hosted, no phone-home. Secrets you configure (e.g. a Search Console key) are used server-side only, never returned by any tool, and content backups deliberately exclude them.