Denis V (Artprima)

<p>Each time you login to your blog WordPress creates a session cookie which is used to authenticate you.<br />
By default if someone somehow gets your cookies he (or she) is able to use them to compromise your blog<br />
(even without having to know your password!). To prevent this you may want to make your auth cookies<br />
ip-dependent so that they could be valid only for that ip which you used during login.</p>
<p>Use this plugin only if you have a static IP or dynamic which doesn’t change too often. Otherwise, you’ll<br />
have to enter your login and password each time your IP changes.</p>


IP Dependent Cookies

Plugin IP Dependent Cookies makes your Wordpress installation more secure adding your IP to salt (which makes cookies IP-dependent).

Ibrahim

<p>Tessera is a developer library for plugin authors who register abilities via <code>wp_register_ability()</code> and want snapshot capture, audit logging, approval workflows, and one-click rollback for every invocation across REST, MCP, internal PHP, and WP-CLI without building it themselves.</p>
<p>Declare what state your ability touches; Tessera handles the safety wrapper.</p>
<h4>What you get out of the box</h4>
<ul>
<li><strong>Pre + post snapshots.</strong> Every safety-enabled invocation captures declared state before the callback and (on success) after, so the audit log can show a real diff.</li>
<li><strong>Audit log.</strong> One row per invocation with ability name, caller (REST/MCP/CLI/internal), user, args, result, status, duration, pre/post hashes, and parent_invocation_id for nested calls.</li>
<li><strong>One-click rollback.</strong> Restore captured state from post_meta, options, taxonomy term assignments, user roles + caps. File contents support tiered drift detection (mtime / mtime_size / critical_hash / full_hash) plus opt-in real byte-level rollback via <code>full_content</code> strategy.</li>
<li><strong>Drift check on rollback.</strong> Live state is hashed and compared to the snapshot’s post-state before restoring; if they differ the rollback returns an error unless forced.</li>
<li><strong>Concurrency lock.</strong> Capture + execute is serialised per surface set via a MySQL advisory lock so two simultaneous invocations do not capture each other’s mid-states.</li>
<li><strong>Encrypted redaction.</strong> Scrub secrets out of args, results, and snapshots. Stores redacted values as AES-256-GCM envelopes so rollback can still restore them.</li>
<li><strong>Approval queue.</strong> When <code>safety.requires_approval</code> is set, the wrapper blocks execution and returns a 202 pending response. A human approves or rejects via wp-admin, WP-CLI, or REST. Multi-stage sequential or parallel approval chains are supported.</li>
<li><strong>Multisite support.</strong> Each subsite gets its own set of <code>wp_<N>_abilityguard_*</code> tables, with auto-install on <code>wp_initialize_site</code> and auto-drop on <code>wpmu_drop_tables</code>.</li>
<li><strong>Retention.</strong> Daily WP-Cron prunes old log rows (defaults: 30 days normal, 180 days destructive) and orphaned snapshots.</li>
</ul>
<h4>Surfaces</h4>
<ul>
<li><strong>PHP API</strong> with <code>wp_register_ability( $name, [ ..., 'safety' => [...] ] )</code> and helpers <code>abilityguard_rollback</code>, <code>abilityguard_snapshot_meta</code>, <code>abilityguard_snapshot_options</code>.</li>
<li><strong>REST</strong>: <code>/abilityguard/v1/log</code>, <code>/log/<id></code>, <code>/log/export</code>, <code>/rollback/<id></code>, <code>/rollback/bulk</code>, <code>/approval</code>, <code>/approval/<id>/approve</code>, <code>/approval/<id>/reject</code>, <code>/approval/bulk</code>, <code>/approval/export</code>, <code>/retention</code>, <code>/retention/prune</code>, <code>/health</code>.</li>
<li><strong>WP-CLI</strong>: <code>wp abilityguard log list/show</code>, <code>wp abilityguard rollback <id></code>, <code>wp abilityguard approval list/approve/reject <id></code>, <code>wp abilityguard prune</code>.</li>
<li><strong>wp-admin</strong>: Tools > Tessera. Hybrid timeline + command-palette search, snapshot drawer, JSON-highlighted Input/Result tabs, invocation chain navigation, and real rollback against the captured snapshot.</li>
</ul>
<h4>Example</h4>
<pre><code>wp_register_ability( 'my-plugin/update-product-price', array(
    'label'               => 'Update product price',
    'description'         => 'Updates the price on a WooCommerce product.',
    'category'            => 'woocommerce',
    'input_schema'        => array( /* ... */ ),
    'permission_callback' => fn() => current_user_can( 'manage_woocommerce' ),
    'execute_callback'    => fn( $args ) => update_post_meta( $args['product_id'], '_price', $args['price'] ),
    'safety' => array(
        'destructive'       => true,
        'requires_approval' => false,
        'snapshot'          => fn( $input ) => array(
            'post_meta' => array( $input['product_id'] => array( '_price', '_regular_price' ) ),
            'options'   => array( 'woocommerce_last_price_change' ),
        ),
    ),
) );
</code></pre>
<h4>Documentation</h4>
<p>Full plugin-author documentation lives at the GitHub repo: https://github.com/ibrahimhajjaj/abilityguard</p>
<h3>Source Code</h3>
<p>The full source for Tessera, including the unminified React source for the admin app, lives on GitHub: https://github.com/ibrahimhajjaj/abilityguard</p>
<ul>
<li>The admin bundle <code>assets/admin.js</code> is compiled from <code>assets/admin.jsx</code> (React + JSX, no preprocessor magic beyond JSX).</li>
<li>The bundler is <a href="https://esbuild.github.io/" rel="nofollow ugc">esbuild</a>, configured in <code>scripts/build.mjs</code>.</li>
<li>To rebuild the admin bundle from a fresh checkout, run <code>npm install</code> once, then <code>npm run build</code> whenever <code>assets/admin.jsx</code> changes. This regenerates <code>assets/admin.js</code> in place.</li>
<li>The release zip published to the WordPress.org directory is produced by <code>scripts/build-release.sh</code>, which excludes development artifacts (tests, examples, build configs) but keeps everything required for the plugin to run.</li>
</ul>


Tessera for the Abilities API

Snapshot, audit, and rollback layer for plugins that register abilities via the WordPress Abilities API.

IP Dependent Cookies vs Tessera for the Abilities API