Plugins

wordpressPreinstallPlugins declares plugins the pod installs, activates and sets to auto-update. The default preinstalls two-factor: given the constant credential-stuffing against WordPress accounts, every site should at least have two-factor authentication available.

wordpressPreinstallPlugins:
  - name: two-factor      # wordpress.org slug
    activate: true        # default
    autoUpdate: true      # default

Semantics worth knowing:

• The script runs in the image's application hook on every container start and is idempotent: it installs only what is missing and activates only what is inactive. An existing installation therefore picks the plugin up on the first rollout after upgrading the chart — no manual step per site.
• Activating two-factor makes 2FA available per user (profile settings); it does not enforce it. Enforcement (e.g. for administrators) is a deliberate second step via the plugin's two_factor_* filters in an mu-plugin, not something a chart default should impose silently.
• The install downloads from wordpress.org, so the pod needs egress to downloads.wordpress.org/api.wordpress.org (the same egress WordPress auto-updates need anyway). Without it the step logs a warning and the pod starts normally.
• Set wordpressPreinstallPlugins: [] to disable.