Security and updates
Secure by default, boring on purpose.
A company website should not need a security plugin. Kaleta ships sensible defaults, signed updates that install security fixes on their own, and automatic backups – with no third-party plugins at all.
Accounts.
Two-factor sign-in with an authenticator app, passkeys, a login limit per IP address and account lockout.
Signed updates.
Every package is signed with Ed25519. The site verifies the signature and every file before installing, and rolls back if anything fails.
Backups.
Automatic database backups, also off-server over FTPS or S3. A restore is validated first and rolls back if the backup is damaged. Media go with the site export.
Content safety.
HTML from non-administrators is sanitised, embeds are limited to an allowlist and the admin runs under a strict Content Security Policy.
Privacy.
No third-party scripts or fonts, cookie-free statistics, and personal data from enquiries deleted after a set period.
Sessions and forms.
Every admin form carries a CSRF token, sessions expire after inactivity and the admin cannot be framed by other sites.
Updates
From GitHub to your site, verified.
New versions are published on GitHub Releases. Your site checks for them, verifies the publisher’s signature and installs them in Settings → Backups and updates. Security releases install on their own by default – no FTP after the first install.
aktualizace.json
signature
Ed25519
signed on
the publisher’s machine, never CI
before install
database backup
on failure
automatic rollback
Reporting
Found a vulnerability?
Please report it privately to info@kaletacms.com rather than in a public issue. We answer within three working days.