Diagnose delivery, permissions, cleanup, and operational boundaries.

How it works

Cybermaps administration pages require manage_options; multisite network settings require manage_network_options.
Settings forms and ordinary admin form/AJAX submissions use WordPress nonces and capability checks before action selectors or payload fields are processed. The administrator Cloudflare OAuth callback validates the administrator and its transaction state before accepting an authorization result.
Quick Setup accepts its exact documented answer schema, rebuilds the preset and preview on the server, and verifies the environment, content, and destination hashes before applying changes.
Private REST reads compare X-Cybermaps-Secret with hash_equals() and send private, non-cacheable responses.
Protected Varnish PURGE requests are disabled until configured and are limited to exact Cybermaps publication URLs.
Report, analytics, and configuration exports require authorization and use explicit content types and filenames, no-cache headers, and X-Content-Type-Options: nosniff. Downloadable formats use attachment disposition; printable report HTML is served inline.
Admin HTML is escaped when emitted, and printable reports use a narrow element/attribute allowlist. JSON, XML, CSV, and text publications retain their own serialization rules so HTML escaping cannot corrupt their bodies.
CSV exports protect spreadsheet-leading formula characters and use UTF-8 output.
Configuration imports are size-bounded, parsed before writes, sanitized by their owning configuration group, and verified after writes. A failed import attempts to restore only values it still owns. Concurrently changed values are preserved; if restoration is incomplete, review the remaining settings and publication status before previewing and retrying the import.
Cybermaps admin responses restrict framing to the same origin with a Content-Security-Policy: frame-ancestors 'self' header.
Public discovery documents are read-only. The admin REST purge requires manage_options. MCP exposes public resources and search only; it provides no remote purge or other administrative tool. Filesystem changes remain ownership-verified.

Publication build responses

HTTP 503 with Retry-After: 5 means Cybermaps could not complete the publication safely. Causes include a busy build, an exhausted work budget, a required read failure, or content/configuration changing during generation. Retry after the stated delay; if the response persists, inspect Debugging and storage health. HTTP 507 with publication_too_large indicates an output-size or PHP memory-headroom limit. Neither response is a completed publication. See AI publishing for the limits and the distinction between a cooperative deadline and a blocked backend.

Diagnostic support bundles

Debugging can collect a short-lived set of bounded diagnostic events. Support bundles omit credential options, request headers and bodies, cookies, and crawler analytics. Redaction of free-form messages is best effort: review the bundle locally for private information before sharing it. If clearing events fails, reload and retry; a clear confirmation does not stop an active logging session from recording later events.