Security and updates
Secure by default, boring on purpose.
A company website should not need a security plugin. Kaleta ships sensible defaults, signed updates that install security fixes on their own, automatic database backups and a firewall you switch on when you need it. Add-ons run only when an administrator switches them on, and a safe mode turns them all off.
Accounts.
Two-factor sign-in with an authenticator app, passkeys, a login limit per IP address and account lockout. Unused accounts and Claude connections are reported, and can be suspended automatically.
Signed updates.
Every package is signed with Ed25519. The site verifies the signature and every file before installing, checks itself afterwards and puts the previous files back if anything fails.
Backups.
Automatic database backups every day something changed, otherwise weekly. Add an FTPS or S3 target and they are copied off the server together with the media. A restore is validated first and rolls back if the backup is damaged.
Content safety.
HTML from non-administrators is sanitised, embeds are limited to an allowlist, every import goes through the same checks, and the admin runs under a strict Content Security Policy.
Privacy.
No third-party scripts or fonts, cookie-free statistics, enquiries deleted or anonymised after a set period, and personal data requests answered in one place.
Sessions and forms.
Every admin form carries a CSRF token, sessions expire after inactivity, and webhooks carry an HMAC signature. Switch on the firewall and it blocks addresses, networks and request floods. SPF, DMARC, DKIM, the certificate and the domain are checked daily.
Updates
From GitHub to your site, verified.
New versions are published on GitHub Releases. Your site checks for them, verifies the publisher’s signature and installs them in Settings → Backups and updates, where you also choose the channel: Latest (the default, a new minor every week) or Stable (security fixes and a new minor about once a month). A site refuses update information older than what it has already seen. Security releases install on their own by default – no FTP after the first install.
aktualizace.json
signature
Ed25519
signed on
the publisher’s machine, never CI
before install
database backup
on failure
automatic rollback
Reporting
Found a vulnerability?
Please report it privately to info@kaletacms.com rather than in a public issue. We answer within three working days.