Secure Plugin Updates Lab
Experiments with delayed auto-updates, provider approval checks, and package integrity gates for WordPress plugin updates.
by Secure Plugin Updates Lab · github.com/danieliser/wp-secure-plugin-updates
★ 0stars
0forks
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/danieliser/wp-secure-plugin-updates/archive/refs/heads/master.zipFrom the readme
Secure Plugin Updates Lab
Experimental WordPress plugin for testing safer plugin update routines in a supply-chain attack model.
The first scaffold focuses on three defenses:
1. Defer automatic plugin updates until the target version is at least X days old.
2. Run provider-based version approval before plugin package installation/update.
3. Verify package hashes and optional author signatures before WordPress unzips an update package.
Local dev with wp-env
Open the wp-env site at the URL printed by wp-env. The admin defaults are usually:
- URL: http://localhost:8888/wp-admin/
- Username: admin
- Password: password
The plugin screen is under Tools - Secure Updates Lab.
Useful commands:
Local dev with WordPress Playground
The Playground CLI mounts this repository into:
The blueprint activates the mounted plugin and opens the lab screen.
Version approval providers
Before WordPress installs or unzips a plugin package, the lab asks registered providers whether the specific {slug, version} is approved.
The built-in provider is:
- releaseage: blocks versions inside the configured defer window.
Local first-seen ledger
The release-age provider prefers a local first-seen tim