Skip to main content
Batoi Press Docs

Security

Review the security model for Batoi Press installations, including installer locking, private directories, sessions, CSRF, uploads, and updates.

Version 1.6.1 Active public source Reviewed Aug 19, 2026 Next review Oct 21, 2026
Start Reading Open Batoi Press GitHub Report documentation issue

Owner: Batoi Engineering Reviewed by: Batoi Press Maintainers Source revision: 72bd58f

Browse Batoi Press Documentation Security
On this page

Security

Batoi Press is designed for small public sites, but it still needs a disciplined security model around installation, admin access, uploads, and updates.

Batoi Press security layers A layered security diagram for public routes, admin sessions, private files, uploads, and updates. Public routes and static assets Admin login, sessions, CSRF, rate limits Private config, content, data, logs, backups Checksummed updates and rollback backups

Installation Lock

After first-run setup, Batoi Press creates:

radpress/config/installed.lock

Keep this file in place. Remove it only when intentionally rerunning setup on a controlled installation.

Private Directories

Protect:

  • radpress/config/
  • radpress/content/
  • radpress/data/
  • radpress/core/
  • radpress/admin/

When possible, keep radpress/ outside the public web root. If not possible, retain the included .htaccess protections.

Sensitive directories in the current build include .htaccess deny rules. Configuration files use JSON, not executable PHP.

Admin Surface

  • Use strong owner passwords.
  • Keep sessions private and short-lived.
  • Use CSRF protection on admin writes.
  • Keep rate limits enabled for login.
  • Expect admin routes to redirect unauthenticated requests to login.
  • Admin write actions record audit log entries for governance review.

Uploads

Uploads should be allowlisted by type, assigned generated filenames, and stored where direct execution is not possible.

The default allowed upload extensions are:

jpg, jpeg, png, gif, webp, pdf, txt, md

The default maximum upload size is 5 MB.

Updates

Only apply packages that match the published SHA-256 checksum and required Ed25519 signatures. Update packages are staged before live replacement, applied from a signed release/package manifest, checked after installation, and automatically rolled back when guarded apply or health checks fail. Update checks use PHP cURL when allow_url_fopen is disabled and may fall back to HTTPS streams only when stream access is enabled. TLS peer and host verification must stay enabled.

Current Hardening Notes

HTML content is sanitized before rendering. The sanitizer preserves semantic structure such as main, header, footer, nav, section, article, aside, fieldset, legend, and tfoot. It also preserves safe inline presentation CSS and HTTPS iframe embeds with constrained attributes and safe loading/referrer defaults. It continues to remove scripts, executable CSS patterns, event handlers, unsafe URLs, and unsafe embed markup. User lifecycle changes are audited, disabled users cannot sign in, and owner safeguards prevent removing the current user or the last active owner. Batoi Press 2.x includes TOTP MFA and recovery codes, encrypted secrets, connection/session step-up, session inventory and revocation, idle and absolute expiry, upload signature checks, browser security headers, operator diagnostics, signed update trust, and non-executing theme compatibility inspection.