Documentation
Security & Architecture Overview
Learn how ReemPress secures communications, protects connected websites, and delivers a reliable WordPress management experience.
On this page
Product
ReemPress is a mobile-first WordPress management platform designed to help website owners manage content, media, products, and updates without opening the WordPress dashboard.
- Mobile-first WordPress management platform
- Manage WordPress without opening WP-Admin
- Available in English and French
- Laravel Hub + WordPress Plugin architecture
Current Features
WordPress Content
- View articles
- Create articles
- Edit articles
- View pages
- Create pages
- Edit pages
- Media library access
- Media uploads
WooCommerce
- Product listing
- Product creation
- Product editing
Updates
- WordPress core updates
- Plugin updates
- ReemPress plugin updates
- One-tap update workflow
Authentication & Access Control
- License activation and verification
- Secure pairing workflow
- Token-based authentication
- Role-based permissions
- Site isolation
- Owner, Agency and Site User roles
Security
Request Security
- HMAC SHA-256 request signing
- Timestamp validation
- Nonce validation
- Replay attack protection
- Dedicated signing secrets
- Request signature enforcement
Transport Security
- HTTPS-only communication
- Cloudflare protected infrastructure
- HSTS enabled
Backend Security
- SSRF protections
- DNS validation
- Private network restrictions
- Fail-closed architecture
- Secret rotation support
- Token expiration and revocation
Reliability
- Idempotency protection
- Duplicate request prevention
- Health monitoring
- Automated nonce cleanup
- Backup procedures
- Rollback procedures
Infrastructure
- Laravel backend
- Docker-based deployment
- PostgreSQL database
- Cloudflare protection
- Staging and production environments
Documentation
- Quick Start Guide
- Security Documentation
- Authentication Documentation
- API Documentation
- Scalability Documentation
- Mobile Documentation
Validation & Review
- External code review completed
- Anti-replay protection validated
- HMAC enforcement validated
- Real-world site testing completed
- Replay attack testing completed
- Signed request validation completed