# Remote WP-CLI Access

Keep this access method disabled until the operator approves the SSH account and remote WordPress path.

## Required variables

- `WP_SSH_HOST`: The approved SSH host.
- `WP_SSH_PORT`: The approved SSH port.
- `WP_SSH_USER`: The name of the restricted SSH account.
- `WP_SSH_KEY_PATH`: The absolute path to the private key outside the repository.
- `WP_SSH_KNOWN_HOSTS_PATH`: The absolute path to the approved `known_hosts` file.
- `WP_REMOTE_PATH`: The approved WordPress directory.

Do not store private keys or credentials in the repository.

## Least-privilege account requirements

Use a dedicated SSH account.
Restrict the account to the approved read-only WP-CLI commands.
Give the account read access only to `WP_REMOTE_PATH`.
Do not give the account permission to use `sudo`.
Keep SSH host-key verification active.

## Read-only verification

```bash
scripts/with-environment.sh ssh .env scripts/wp-read.sh core version
```

Use only commands that `scripts/wp-read.sh` permits.
The `ssh` mode exports only `WP_SSH_*` and `WP_REMOTE_PATH` values.

## Prohibited actions

Do not create, update, install, activate, deactivate, import, or delete data.
Do not flush caches or rewrite rules.
Do not run arbitrary PHP or shell code.
Do not bypass the read-only wrapper.
Do not bypass SSH host-key verification.

## Production write boundary

This repository never authorizes production writes.
Operator approval does not enable writes through this template.
Use a separate access method for an approved production write.
Use a change procedure outside this scaffold for that write.

## Required approval

Get operator approval before you enable remote WP-CLI access.
The approval must identify the SSH account, key, known-hosts file, and remote WordPress path.