Security

Security is not a feature —
it’s the foundation.

AdminLocks is built security-first for agencies handling client data. Every line of code, every data flow, every access path is designed with the assumption that trust must be earned, not assumed.

Core Principles

Built on four pillars

These aren't aspirational goals. They're architectural decisions baked into every release.

Zero Trust Architecture

Deny by default, allow explicitly. Every request is authenticated, every action is authorized, every permission is scoped to exactly what's needed.

Data Minimization

Only collect what's needed, purge what's not. We don't harvest telemetry, we don't phone home, and retention policies are in your hands.

Defense in Depth

Multiple layers of protection so that no single vulnerability means total compromise. Input validation, capability checks, encryption, and audit logging work in concert.

Transparency

Open-source Lite plugin, public changelog, responsible disclosure program. You can audit what runs on your server. No black boxes.

Technical Details

How we secure every layer

From the plugin code running on your server to the cloud infrastructure syncing your fleet.

Plugin Security

WordPress-native hardening on every action

All inputs sanitized with WordPress sanitize_* functions
Nonce verification on all forms and AJAX requests
Capability checks on every admin action
Prepared statements for all database queries — no raw SQL
No eval(), no remote code execution vectors
PHPCS + WordPress Coding Standards compliance

Cloud Security

Enterprise-grade infrastructure for your command center

TLS 1.3 on every connection
Data encrypted at rest with AES-256
JWT tokens with short expiry and refresh rotation
Rate limiting on all API endpoints
SOC 2 compliance roadmap in progress

Data Handling

Your data, your rules, full stop

Audit logs stored on your server (Lite) or encrypted cloud (Cloud)
No tracking, no analytics pixels, no third-party data sharing
GDPR-compliant data export and deletion
Configurable data retention policies

Access Control

Granular permissions at every level

Role-based access with principle of least privilege
Two-factor authentication support (Cloud)
Session management and forced logout
IP allowlisting (Cloud)

Responsible Disclosure

Found a vulnerability? We take security reports seriously. Please disclose responsibly and we'll respond within 24 hours. We won't pursue legal action against researchers acting in good faith.

security@adminlocks.com

Please include reproduction steps, affected versions, and potential impact in your report.

Trust Signals

Compliance & standards

WordPress.org Reviewed

Lite plugin passes the WordPress.org plugin review team's security and coding standards checks.

OWASP Top 10 Addressed

Every release is evaluated against the OWASP Top 10 web application security risks.

GDPR Compliant

Full data export, right-to-deletion, configurable retention, and no third-party data sharing.

Questions about security?

We're happy to discuss our security practices, answer audit questionnaires, or walk through our architecture.