Hardening notes for shipping a WordPress blog to a VPS with a restricted deploy helper.
Least privilege
Give the SSH account passwordless sudo only for a single helper binary. That helper owns backups, staging directories and rsync into wp-content.
Warning: Deploying as root works, but a dedicated deploy user is safer long term.
Smoke test
sudo -n /usr/local/sbin/lownkey-deploy-helper wp core version
Leave a Reply