Security designed around real website operations.

Account protection

Passwords use a salted memory-hard hash. Sessions are HTTP-only, same-site and secure in production. Authenticator MFA and one-time recovery codes are available from Account & security. Sensitive WordPress credentials require fresh password verification and MFA when enabled.

Credential handling

Hostinger, OAuth, AI and WordPress secrets are encrypted at rest with the deployment encryption key. APIs redact secrets from normal responses and structured logs. Credential reveal activity is added to the account security trail.

Reliable automation

Provisioning, plugin installation, theme import, publishing, audits and search sync use durable jobs with leases, idempotency keys, bounded retries and dead-letter visibility. Temporary provider responses are verified before retrying to avoid duplicate mutations.

Application and data controls

• Content Security Policy, HSTS, frame protection and restrictive browser permissions.
• Cross-site request checks, JSON-only mutations and authentication rate limits.
• PostgreSQL normalized operational projections with optimistic revision protection.
• Daily snapshots, integrity hashes and configurable retention for disaster recovery.
• User data export and delayed account deletion with a cancellation window.

Responsible disclosure

Send a clear description, affected URL, reproduction steps and impact to security@zorqen.co. Do not access other users’ data, disrupt live sites or publish a vulnerability before remediation is coordinated.