There was an error while loading. Please reload this page.
Document update email versions and the WordPress mail templates Mail-Templates.md now documents that, since Panopticon 2.3.1, the extensions_update_done and plugins_update_done emails state the old and new version of each piece of software in their rendered output, and why there are deliberately no [OLD_VERSION]/[NEW_VERSION] variables for these two batch emails. Note that a User Code override of the Blade files keeps precedence and must be re-created to pick this up. The WordPress mail templates (plugins_update_done and plugin_update_found) were entirely undocumented; add a section mirroring the Joomla one, including the [SOFTWARE_*] variables and their [EXTENSION_*] aliases. Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Document Connection Doctor access control and why a block list is observable Renames the Site definition limits area to Site and Tools Limits and documents the new Connection Doctor access option: what the three modes are, why the option exists (the Forbidden IP Ranges list can only ever be as complete as the operator made it, and the Connection Doctor is what turns an unlisted internal host into a readable one), and the explicit trade that restricting it moves the support burden onto the operator. Adds a standalone "A block list is always observable" section. Anyone who can add or edit a site can infer the deny list by submitting addresses and noting which are refused. This is not fixable — the acceptance or refusal is itself the answer, whatever the error message says — and it is not specific to Panopticon. The section makes the iptables comparison explicitly: you cannot enforce a boundary against somebody without that somebody being able to detect where the boundary is. The section is written to be linkable as a considered, public position, because this will be reported as a vulnerability with an inflated impact assessment sooner or later. It states what an adversary actually learns (which addresses the operator chose to list — a fact about configuration, not about what runs there), why that knowledge is only useful as reconnaissance for a read they can be denied, that the only complete fix is not offering self-service site creation at all, and that this use case is optional and off by default. It also states the two things which remain visible regardless — blind request initiation through background tasks, and the up/down signal from uptime monitoring — so the operator's risk assessment is made against the real picture rather than a flattering one. Also adds a Connection Troubleshooting entry and a note on the Connection Doctor page itself for users who find the tool missing. Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Document the Forbidden IP Ranges site definition limit (GHSA-6234-p3mh-7j3x) Covers the new Site definition limits area on the Security tab of Global Configuration: what the option is for, the deployment it is aimed at, the four accepted range formats, cloud instance metadata addresses, and a warning against copying the suggested starting list blindly onto an installation which legitimately monitors its own LAN. Also cross-references it from the places a user actually hits the problem: the self-service user setup in Users and Groups, the connection troubleshooting pointer in Managing Sites, and a new CMS-agnostic entry in Connection Troubleshooting for the generic rejection message. Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Document X-Panopticon-Token fallback and supergateway for header-stripping hosts [gh-1010] Some shared hosts (cgi-fcgi / LSPHP with restricted AllowOverride) strip the Authorization header before PHP starts, where no server-side workaround can recover it. Document the X-Panopticon-Token header as the reliable fallback, with a working supergateway MCP configuration, and add missing_token / no_secret troubleshooting guidance (the latter fixed in Panopticon 2.2.1; re-mint tokens).
Document token-auth transport for MCP server and JSON API [gh-1010] Make /index.php/mcp the canonical MCP endpoint (works on every server); the short /mcp form requires a rewrite rule (added to htaccess.txt in 2.2.1). Document Authorization-header forwarding for Apache, Nginx, and IIS, add a minimal self-managed .htaccess snippet, correct the IIS claim (not automatic), require URL-encoding for the _panopticon_token query parameter, and expand MCP troubleshooting to distinguish a plain 404 (routing) from a JSON 404 (disabled) and a 401 caused by header stripping. Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Automation
Main page info on the MCP server
Admonitions
Document the optional MCP server [gh-1000] Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Document configurable Core File Integrity checksums source [akeeba/panopticon#981] Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Note version requirements for WordPress Core File Integrity Check [akeeba/panopticon#979] Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Troubleshooting information for core updates
Document WordPress support for Core File Integrity Check [gh-979] Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Add comprehensive CLI reference documentation Adds six new wiki pages covering every CLI namespace with practical examples, use cases, and context that goes beyond the built-in help: CLI-Reference (overview and conventions), CLI-config (config:* and database:*), CLI-site (site:* — 25 commands), CLI-user-and-group (user:* and group:*), CLI-task-and-schedules (task:*, backup:schedule:*, scanner:schedule:*), and CLI-maintenance (mailtemplate:*, selfupdate:*, log:*). Updates CLI-setup.md and the sidebar to link to all reference pages. Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Fill documentation gaps, fix accuracy issues, and add missing pages New pages: - Backup-Tasks.md — scheduling Akeeba Backup jobs per site - Scanner-Tasks.md — scheduling Admin Tools PHP File Change Scanner jobs per site - Tasks.md — central task management admin page - Database-Backups.md — Panopticon's own database backup feature - Connection-Doctor.md — in-app connection diagnostic tool Accuracy fixes: - Home.md: PHP minimum updated from 8.1/8.2 to 8.3/8.4 (matches AKEEBA_PANOPTICON_MINPHP) - Managing-Sites.md: connector section updated to include Joomla 6 - CLI-setup.md: add --loop to task:run cron examples; add further CLI commands section - Plugin-Events.md: fix wrong event name (onTaskBeforeJoomlaUpdate → onBeforeJoomlaUpdate); fix copy-paste typo in onAfterBuildQuery signature; add missing onAfterJoomlaUpdate, onBeforeWordPressUpdate, onAfterWordPressUpdate, onBeforeDispatch, onAfterDispatch events - Scheduled-Update-Summary.md, Scheduled-Action-Summary.md: tone down LLM/CRON warning - _Sidebar.md: add Connection Doctor entry Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>
Document the JSON API
Documentation update
Update shields with Joomla! 6
Document Remote Extension Installation feature Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Document core file integrity check feature Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add links to Panopticon connector extensions and update supported CMS list Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Document Web Push Notifications feature Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add documentation for legal policies, user consent, and PII self-management Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Document user self-registration, CAPTCHA providers, and registration mail templates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Updated _Footer (markdown)
fixes typo
typo wrongky => wrongly
Notes on setting up CRON, and the pitfall of the CRON daemon not being enabled
Updated Site Parameters (markdown)