Absoluit User Hub

Absoluit User Hub is a powerful, secure, centralized user management system designed specifically for WordPress. It enables network administrators to manage user accounts (create, update, search, and delete) across multiple connected child sites from a single, centralized WordPress master dashboard.

The system is distributed as a single unified plugin package that supports three active roles:
1. Master Dashboard Mode: Run on your central administration site. Exposes the main “User Hub” dashboard menus, connection diagnostics, AJAX controllers, and custom database mapping.
2. Client Agent Mode: Run on individual child nodes. Exposes custom REST API endpoints under a private namespace (wp-user-hub/v1) protected by a strict multi-layer verification middleware.
3. Both Mode: Runs both components simultaneously on a single WordPress installation (primarily used for local development and debugging).

Upon first activation, the plugin resides in a safe, uninitialized state and prompts the administrator to select the site’s role before loading any features.

Architecture Overview

• Central Dashboard (Master): The administrator interacts with the dashboard UI to trigger user operations. The Master component dispatches secure, signed REST requests to connected child sites using WordPress HTTP APIs.
• Child Nodes (Client): Expose custom REST API endpoints. An authentication middleware verifies credentials, allowed IP addresses, timestamp drift boundaries, and duplicate nonces before modifying the local WordPress user database.

Security

Absoluit User Hub implements several security controls to protect your user database:
* API Key Authentication: A high-entropy shared secret generated for each child site.
* IP Allowlisting: Strict enforcement restricting REST API requests to whitelisted Master IPs.
* Timestamp Drift Validation: Rejects requests where the server time difference exceeds 300 seconds to prevent outdated requests.
* Nonce Validation: Caches request nonces via transients to block replay attacks.
* HMAC-SHA256 Request Signing: Incoming request parameters are cryptographically signed using the shared secret API Key, ensuring payload integrity.
* Primary Admin Protection: Hardcoded checks explicitly block the deletion of user ID 1 (Primary Administrator).

Best Practices:
* Always run WordPress over HTTPS.
* Restrict Allowed Master IPs on the Client settings.
* Keep WordPress and plugins updated.
* Protect and rotate API keys regularly.