Install lockdown

Install lockdown stops anyone from installing new plugins or themes or uploading plugin and theme ZIP files, even through a vulnerable plugin that skips permission checks. Updates of what is already installed keep working. When you need to install something, you unlock installs for a short time, and every unlock is logged and e-mailed.

It is meant for sites where nobody installs plugins day to day. While the site is locked, a plugin bug that lets visitors install plugins without the right permissions cannot install anything. Someone with a stolen administrator login has to unlock first, which is logged and e-mailed. With unlocking only from WP-CLI, they cannot unlock from wp-admin at all.

Module ID	lockdown
Default	Off
Available	Unless DISALLOW_FILE_MODS is set to true. SafeHouse then shows "DISALLOW_FILE_MODS in wp-config.php already blocks all installs and updates."
WP-CLI	wp shouse unlock, wp shouse lock (only while the module runs)
Since	0.1.0

How it works

Two layers

While installs are locked, SafeHouse blocks them in two places:

1. Capabilities. Nobody, administrators included, has install_plugins, install_themes, upload_plugins, upload_themes, edit_plugins, edit_themes or edit_files. WordPress hides the screens and buttons for adding plugins and themes, and the theme and plugin file editors.

2. The WordPress installer. Any install of a plugin or theme through WordPress's installer is stopped, even when the code that started it never checked permissions. The installer returns this error, and the activity log gets an install_blocked entry such as "Blocked a plugin install while locked":

   Installing plugins and themes is locked by SafeHouse. Unlock it first (SafeHouse in the admin menu or `wp shouse unlock`).
   

The second layer also stops wp plugin install and wp theme install in WP-CLI, because they use the same installer.

Because the first layer takes edit_plugins, edit_themes and edit_files away, the file editors disappear while installs are locked, even when Hardening's Disable the theme/plugin file editor is off.

What keeps working

• Updates of installed plugins and themes, manual and automatic
• WordPress core updates
• Translation updates
• Activating, deactivating and deleting plugins and themes that are already installed

While locked, Details says: "Locked. Updates of installed plugins, themes and core still work."

This is the difference from DISALLOW_FILE_MODS, which blocks updates too. When that constant is set to true in wp-config.php, Install lockdown is Unavailable.

Unlocking

An unlock opens installs for the whole site, for everyone and for every code path, until it ends:

• From the settings page, an unlock always lasts 30 minutes.
• From WP-CLI, it lasts 30 minutes unless you pass --minutes, from 1 to 240.

Every unlock writes lockdown_unlocked to the activity log, for example "Installs unlocked for 30 minutes via settings page", and e-mails the alert recipients:

Subject: [SafeHouse] SITE NAME: installs unlocked

Plugin and theme installs were unlocked for 30 minutes by jan (settings page).

When the time is up, installs lock again without a log entry or an e-mail. Locking early with Lock now or wp shouse lock writes lockdown_locked ("Installs locked again") to the log and sends no e-mail.

The lockdown also adds to Change alerts, which reports any new plugin directory at its next hourly check, however it got there.

Settings

Install lockdown has no settings. While it runs, Details shows the state and one button:

State	Text	Button
Locked	"Locked. Updates of installed plugins, themes and core still work."	Unlock installs for 30 minutes
Unlocked	"Unlocked until 14:35." (in the site's time format)	Lock now

Unlock to install a plugin or theme

In wp-admin:

1. Go to SafeHouse → Modules → Install lockdown and select Details.

2. Select Unlock installs for 30 minutes.

   SafeHouse shows "Installs are unlocked for 30 minutes." and e-mails the alert recipients.

3. Install the plugin or theme as usual.

4. Go back to SafeHouse → Modules → Install lockdown and select Lock now.

   SafeHouse shows "Installs are locked."

With WP-CLI, unlock for the default 30 minutes:

wp shouse unlock

Or for another time, from 1 to 240 minutes:

wp shouse unlock --minutes=10

The command prints the end time in the site's time zone, for example Success: Installs unlocked until 14:35. Lock again when you are done:

wp shouse lock

It prints Success: Installs locked.

Allow unlocking only from WP-CLI

To keep the unlock button out of wp-admin, so that a stolen administrator session cannot unlock installs, add this to wp-config.php:

define( 'SHOUSE_LOCKDOWN_UI_UNLOCK', false );

Unlock installs for 30 minutes then disappears, and SafeHouse refuses a forged unlock request with "Unknown task." wp shouse unlock keeps working. While installs are unlocked, Lock now still shows.

Turn the lockdown off

To install plugins often for a while, switch the module off on SafeHouse → Modules and select Save Changes, or run:

wp shouse module disable lockdown

If the module is pinned with SHOUSE_MODULES in wp-config.php, change it there.

What it stores

• Option shouse_lockdown_until: the time the current unlock ends. Nothing else is stored.
• Activity log entries: install_blocked (a blocked install), lockdown_unlocked (every unlock), lockdown_locked (an early lock).
• One e-mail per unlock.

Limitations

• An unlock opens installs to everyone and to every code path for its whole length, including the vulnerable plugin the lockdown protects against. Keep unlocks short and lock again when you are done.
• The lockdown covers WordPress's installer and the install capabilities only. Code that writes files straight to disk, for example through a file upload bug or FTP, is not stopped. Change alerts reports new plugin directories, must-use plugins and drop-ins found that way.
• Updates are not restricted: the lockdown lets through whatever the update source of an installed plugin or theme delivers.
• The settings page always unlocks for 30 minutes. Other durations need WP-CLI.
• Locking again, early or when the time runs out, is not e-mailed.
• The lockdown does not stop activating a plugin that is already installed but inactive. Delete plugins you do not use (Plugin health lists them).

Related pages

• Change alerts
• Hardening
• Plugin health
• Configuration constants
• Command line reference