Fortress Security Part 2: Installation and Configuration Guide

Strict Mode in Vaults and Pillars

Strict Mode provides a higher level of security by enforcing stricter checks and validations on the options. When enabled, it introduces the following changes and ensures that the system doesn’t fall back to insecure defaults:

• An exception is thrown if an option with any Vaults or Pillars is missing in the database.
• An exception is thrown if a required environment variable (ENV var) is not found in the runtime.
• An exception is thrown if the database value for a Vault is not encrypted yet, as this might indicate that an attacker tried to update it.
• All Vaults become immutable, just like Pillars, meaning their values can’t be changed after they’re initially set.
• Updates of options with Partial Vaults/Pillars to a non-array value are disallowed and will return false.
• An exception is thrown if any sub-key of a Partial Vault/Pillar, or its parent, is missing in the database during a fetch operation.
• An exception is thrown if an option with Partial Vaults/Pillars is not an array in the database.
• Options can no longer be deleted using delete_option() function.
• Options associated with at least one Vault/Pillar can no longer be added using the add_option() function.

Strict Mode best suits environments where security is paramount, but it should be enabled with caution by first thoroughly testing in a staging environment.

Checking if Strict Mode is activated

By default, Strict Mode is NOT active, so it will not be active unless you have explicitly activated it in the past.

You can verify if strict mode is enabled with the following WP-CLI command:

$ wp snicco/fortress shared cache:config --key=fortress.vaults_and_pillars.strict_option_vaults_and_pillars

false

The returned value indicates whether the strict mode is active (true) or inactive (false).

Enabling Strict Mode

You can enable Strict Mode in your Fortress configuration JSON file by setting the strict_option_vaults_and_pillars attribute to true:

{
  "vault_and_pillars": {
    "strict_option_vaults_and_pillars": true
  }
}

The default value is false. However, enabling Strict Mode is highly recommended in production environments.

Disabling Strict Mode

Deactivating has no adverse effects.
You can turn off the Strict Mode by updating the strict_option_vaults_and_pillars option to false in your configuration:

{
  "vault_and_pillars": {
    "strict_option_vaults_and_pillars": false
  }
}

Reload Your Configuration

To ensure that your configuration is valid and set your changes live,  run this WP-CLI command to check the Fortress syntax and clear the cache (replace site.url with your website URL):

gpfort site.url -cli shared config:test --reload-on-success

Additional Notes

• You can read the official developer documentation here.