Community Registry — server & operations checklist (you complete these)
================================================================================

The plugin works on a typical Apache + PHP WordPress host without opening this
file. Debug logs live in wp-content/cr-registry-private/ and the plugin writes
.htaccess rules there and under cr-uploads/ automatically on Apache.

Complete the items below only where they apply to your stack or your policy.
Nothing here is required for the PHP code in the first group of improvements.


1) Nginx (or other non-Apache front ends)
   --------------------------------------
   .htaccess is ignored. Block direct HTTP access to the private log directory
   and (optionally) harden patterns under uploads.

   Example (adjust server_name and root to match your site):

     location ^~ /wp-content/cr-registry-private/ {
       deny all;
       return 403;
     }

   Optional: deny only sensitive extensions under cr-uploads if your vhost
   serves that tree publicly.


2) IIS / web.config
   -----------------
   Add URL rewrite or request blocking rules equivalent to the above so
   /wp-content/cr-registry-private/ is not browsable or downloadable.


3) Operations / security policy
   -----------------------------
   - Turn off Registry → Debug log when you are not actively troubleshooting.
   - Do not leave define( 'CR_DEBUG', true ); in wp-config.php on production
     longer than necessary.
   - Treat downloaded debug logs like credentials: store securely, delete when
     done. They may contain paths, SQL fragments, and stack traces.


4) Optional advanced hardening
   ----------------------------
   If your host provides a filesystem path outside the web document root, you
   could symlink or configure backups to exclude cr-registry-private from public
   sync jobs. The plugin does not require this.


5) Leftover file after upgrading from older releases
   ---------------------------------------------------
   Versions before 2.13.2 stored cr-debug.log under wp-content/cr-uploads/.
   The plugin migrates it automatically when possible. If a copy remains under
   cr-uploads/, you may delete it manually after confirming the new log under
   cr-registry-private/ is updating as expected.


---
Plugin version: use the * Version: line in community-registry.php (same number WordPress shows under Plugins).
