Why does wpfy site ssl fail with "DNS does not match public IP"?

wpfy refuses to request a Let's Encrypt certificate unless the domain's DNS A (and AAAA) records resolve to your server's public IP. This prevents failed ACME challenges and accidental certificate issuance for a domain you don't control.

Fix:

1. Check DNS: dig +short example.com
2. Check your public IP: curl -s ifconfig.me
3. They must match. Update DNS at your registrar and wait for propagation.

What does the preflight actually check?

preflight_ssl() compares the domain's resolved A/AAAA records against the server's detected public IPs. Only when they match does wpfy proceed to ACME issuance. See SSL Flow.

Can I test SSL without real DNS?

Yes, offline:

WPFY_TEST_DNS_IPS=1.2.3.4 WPFY_TEST_PUBLIC_IPS=1.2.3.4 wpfy site ssl example.com -le

This fakes a DNS/IP match so the preflight passes. Do not use this in production — it bypasses the safety check.

I enabled SSL. Now my site redirects oddly.

Enabling SSL updates WordPress home and siteurl to https://<domain> after the runtime restarts. If redirects fall back to HTTP, run wpfy site status example.com to confirm the runtime restarted, then clear WordPress/object cache. See Site SSL.

How do I force HTTPS?

Traefik handles the redirect once the SSL router is active. You don't need a separate plugin. If a site was created without -le, enable SSL:

wpfy site ssl example.com -le

Backups and restore

• wpfy site backup example.com — timestamped tarball to /var/lib/wpfy/backups/
• wpfy site restore example.com <backup>.tar.gz — restore files and database

Backups are never world-readable. Never restore one site's secrets into another. See Site Backup and Site Restore.