Skip to content

Server connection security: credentials, host keys and our IP address

How WP Safer stores SSH, SFTP and FTPS credentials, checks host keys and certificates, which IP address it connects from and what the access history records.

Last updated

Adding a server means trusting WP Safer with a way in. This article explains what WP Safer stores, how it makes sure it is talking to your server and not an impostor, which address it connects from, and what is recorded each time it signs in.

With the agent: no inbound access at all

  • The agent only makes outgoing HTTPS requests to WP Safer. No port is opened on your server and WP Safer never signs in to it.
  • Each server has its own access token. WP Safer stores only a hash of it; the token itself is in /etc/wpsafer-agent/agent.conf, readable by root only, and never appears in the process list.
  • The install code is valid for 30 minutes and works once.
  • The agent carries out only a fixed list of commands (refresh settings, update, remove itself, run a backup job you created). Nothing typed into the panel is run as a shell command.
  • Database logins stay on the server: the agent reads them from a file there and they are never sent to WP Safer.
  • If the token may have leaked, Revoke token on the Settings tab rejects the agent at its next report.

Without the agent: the credential vault

For SSH, SFTP and FTPS, WP Safer has to keep a way to sign in. It keeps it like this:

  • Passwords and private keys are encrypted with XChaCha20-Poly1305 before they are written, with a key that is kept outside the database. Each encrypted value is bound to its server, so it cannot be copied to another server’s record and opened there.
  • They are never shown again after you enter them — not in the panel, not in emails, not in logs. Error messages are cleaned of anything secret before they are stored.
  • With an SSH key, WP Safer creates a separate key pair for each server. The private key never leaves WP Safer; you only ever handle the public key. The line it adds to authorized_keys ends in wpsafer-server-<id>, so you can always tell which line is ours.
  • Database passwords (for mysqldump over SSH) reach mysqldump through a temporary file, never on the command line where other users could see them.
  • When you remove a server, its saved credentials are deleted at once and WP Safer never connects to it again.

To revoke access yourself at any time, delete our line from authorized_keys or change the user’s password on the server.

Host keys and certificates: no talking to an impostor

The first successful connection test saves the server’s identity: the Server host key for SSH and SFTP, the TLS certificate for FTPS. From then on, if the server presents a different identity, WP Safer stops before sending the password or key, and the server page shows The server’s SSH host key changed (or The server’s TLS certificate changed).

That is expected after a server was reinstalled or moved. If you did not change the server, it can mean someone is intercepting the connection: check with your host before you continue. When you know why it changed, press I changed the server — forget the saved fingerprint; the next connection test saves the new identity. Changing the server address or port also forgets the saved fingerprint.

FTPS is weaker than SFTP here

With SFTP and SSH the host key is checked inside the very connection that carries your password. FTPS does not allow that: WP Safer reads and compares the certificate in a separate check just before signing in, but the connection that then carries the password does not verify the certificate itself. A changed certificate is still caught, but an attacker who intercepts only that one sign-in could go unnoticed. If your host offers SFTP, prefer it. Plain FTP is refused, and so is implicit FTPS on port 990.

The address WP Safer connects from

Every SSH, SFTP, FTPS and direct database connection comes from 188.245.5.241. If a firewall limits SSH or FTP on your server, allow incoming connections from that address on the port you entered (for example 22 for SSH and SFTP, 21 for FTPS, 3306 for a direct database connection). The agent needs no such rule.

WP Safer also refuses to connect to private, local or reserved addresses, so a server record cannot be used to reach machines inside our own network.

Access history

The Access history on the Settings tab lists, for the last 90 days, every time WP Safer signed in to the server with the saved credentials: when, why (Connection test, Backup, Database dump), the result and how long it took. Reachability checks only appear when the result changes. If you see a sign-in you cannot explain, remove the server or revoke our access on the server.