Frequently asked questions about SSL and the DNS/IP preflight. Post new questions in this category. Why does wpfy site ssl fail with "DNS does not match public IP"? wpfy refuses to request a Let's Encrypt certificate unless the domain's DNS A (and AAAA) records resolve to your server's public IP. This prevents failed ACME challenges and accidental certificate issuance for a domain you don't control. Fix: Check DNS: dig +short example.com Check your public IP: curl -s ifconfig.me They must match. Update DNS at your registrar and wait for propagation. What does the preflight actually check? preflight_ssl() compares the domain's resolved A/AAAA records against the server's detected public IPs. Only when they match does wpfy proceed to ACME issuance. See SSL Flow. Can I test SSL without real DNS? Yes, offline: WPFY_TEST_DNS_IPS=1.2.3.4 WPFY_TEST_PUBLIC_IPS=1.2.3.4 wpfy site ssl example.com -le This fakes a DNS/IP match so the preflight passes. Do not use this in production — it bypasses the safety check. I enabled SSL. Now my site redirects oddly. Enabling SSL updates WordPress home and siteurl to https://<domain> after the runtime restarts. If redirects fall back to HTTP, run wpfy site status example.com to confirm the runtime restarted, then clear WordPress/object cache. See Site SSL. How do I force HTTPS? Traefik handles the redirect once the SSL router is active. You don't need a separate plugin. If a site was created without -le, enable SSL: wpfy site ssl example.com -le Backups and restore wpfy site backup example.com — timestamped tarball to /var/lib/wpfy/backups/ wpfy site restore example.com <backup>.tar.gz — restore files and database Backups are never world-readable. Never restore one site's secrets into another. See Site Backup and Site Restore.