Security and abuse: Arx on the network, phishing on lamoi.fi, incident runbook
Imported from GitHub issue El-SaMa/lamoi-waas#18 by @El-SaMa.
Tasks
- Arx on the network: WAF rules, bot control, malware scan per subsite (results mapped to the subsite and its owner).
- Login protection, 2FA for super admins, optional 2FA for site owners.
- Abuse: cheap subdomains attract phishing, which can get lamoi.fi blocklisted. Paid plans only (no free tier without verified payment), Turnstile on sign-up, automatic scan of new sites for phishing kits and brand impersonation, Safe Browsing / blocklist monitoring for lamoi.fi, takedown flow (suspend + notify) in OMA.
- Isolation documentation and limits: per-site PHP memory and execution limits, upload quotas, request rate limits.
- Incident runbook: compromised subsite, compromised plugin across the network, data breach notification duties.
Acceptance criteria
- A test phishing page on staging is detected and the site suspended by the flow.
Depends on
#4, #13.
Plan key W23. Epic: El-SaMa/lamoi-waas#25.