Plugin Security Check and Update Runbook A clean workflow diagram showing how WordPress plugin security risks are detected, approved, tested on development, manually updated on production by Holly or Nathan, and verified after production changes. Plugin Security Check and Update Runbook Security risks are reviewed, tested against a production baseline, manually updated on production, then verified again. Automated Human decision Forge action Regression test Stop / escalate DETECTION AND APPROVAL 1 Weekly Site Report check Cron pulls WPE Site Reports and posts every plugin/theme flagged "Security risk" to #security-checks. 2 Holly / Nathan review and approve Decide which flagged plugins get updated and which are skipped, removed, replaced, or handled manually. Known limitation: WPE scan items are not severity-ranked here unless a manual security-detail check adds severity, exploit status, and fixed-in version. SAFE TESTING ON DEVELOPMENT OR STAGING 3 Pull from Production Full copy from live site to dev before updates. WPE creates the restore point automatically. 4 Regression test - BEFORE Capture and review uncached production baselines. No cached output is valid comparison source. 5 Update approved plugins on dev Apply only approved updates. Production is not touched. Stop and report if an approved update fails. 6 Regression test - AFTER Compare dev against the verified uncached baseline. Run uncached; triage before publishing the hub. Checkout flow stops at payment/card-info; it never places orders. Clean pass? No real regressions and no unresolved blockers yes no Step 9 - Stop and report No auto-retry and no auto-rollback. Report the page, plugin, likely cause, timestamp, and OC hub URL. PRODUCTION - ONLY AFTER A CLEAN REGRESSION PASS 7 Holly / Nathan manually update production Human action only. This is not a dev-to-production overwrite. Forge does not update the live site. 8 Regression test - production Run the same checks on the live site. Publish or update the final OC hub gallery. Done: update verified on production Regression Suite role The Playwright Regression Suite supplies the baseline captures, post-update comparisons, checkout-flow checks, diff triage inputs, and gallery artifacts. Full documentation: /website-security/regression-suite/ Runbook page: /website-security/ Runbook defined 2026-08-21 - first executed 2026-08-24 - weekly detection automation added 2026-08-27 - hub publication required 2026-09-25 Project file: workspace-shared/projects/plugin-security-check-and-update.md