What WP Nexus can do to your sites, and what it cannot
A tool with write access to every client site earns trust by being specific about its limits. These are the controls that constrain what WP Nexus is able to do.
Credentials never reach the browser
Site keys, API tokens and provider payloads are encrypted at rest and stay server-side. The interface receives filtered projections only, so a compromised browser session cannot leak a credential that was never sent to it.
- Encrypted at rest, write-only in the interface
- No bearer tokens held in the browser
- Secrets excluded from logs and audit records
Every outbound target is checked
Before any credential is sent, the destination is validated: scheme, port, DNS resolution and public address are all confirmed, with connection pinning and verified TLS. Private and reserved addresses are refused outright, and redirects are denied by default.
- Verified TLS with pinned addresses
- Private and reserved addresses refused
- Redirects denied unless explicitly allowed
Destructive actions need a person
Deletions, restores and rollouts require current-password confirmation at the moment of the action, carry a replay-protected identifier, and write an immutable audit record. Bulk destructive execution stays deliberately unavailable.
- Step-up password confirmation
- Replay protection on every mutation
- Immutable audit trail with actor and time
Failure is visible, not smoothed over
Stale data, denied permissions, unreachable sites and ambiguous outcomes are shown as themselves. An operation whose result could not be confirmed is reported as ambiguous and never retried blindly, because a blind retry on an unclear result is how data gets duplicated or lost.
- Ambiguous outcomes are never blind-retried
- Degraded states are labelled, not hidden
- Reconciliation requires human review
Tenant isolation
Every read and write is scoped to an agency and checked against an explicit permission. Cross-tenant access is denied at the route boundary and covered by negative tests, so a bug in one workspace cannot expose another.
- Agency scope and permission checked independently
- Cross-tenant denial covered by tests
- Owner, admin and member roles enforced server-side
See how Nexus fits your operating model
Start with a scoped conversation. No subscription begins from this page.