WASP: WordPress Advanced Security Platform on the Internet Computer (alternate solution)

[miadey]

TL;DR: This a solution we came up with until we are possibly able to run Wordpress entirely on a canister. WASP uses ICP canisters as a security and caching layer in front of WordPress backends. If a server dies, your sites automatically restore to a standby TEE server from blockchain backups within minutes.

What WASP Is (And What It Isn’t)

WASP is not about running PHP inside a canister. Instead, it’s a hybrid architecture where ICP canisters act as an intelligent edge layer that caches content, queues forms, and handles authentication, while WordPress runs on traditional TEE SERVER servers behind the scenes.

User → ICP Boundary Nodes → wp_site Canister (cache/auth/forms) → WordPress TEE SERVER

The Key Feature: Automatic Disaster Recovery

Server Dies? Sites Restore Automatically

When a TEE SERVER fails, WASP does not just failover traffic, it restores your entire WordPress site to a standby server automatically:

1. Continuous Backup to Blockchain: Your database and files sync to ICP canisters in real-time (every 30 seconds for transaction tables, chunked in 2MB pieces with delta detection)

2. Circuit Breaker Detection: The wp_site canister tracks backend health. After consecutive failures, it opens the circuit and returns a 503 while coordinating with the orchestrator

3. Automatic Restore on Boot: When a new/standby TEE server starts, the wasp-agent runs run_startup_check() which:

o Gets list of sites assigned to this TEE SERVER from the orchestrator

o Checks each site: Does the directory exist? Is wp-config.php present? Are database tables populated?

o If anything is missing, automatically restores from canister backup

4. Sites Back Online in Minutes: Database tables restore first (parallel chunk downloads), then files. Docker containers start automatically. Validation confirms WordPress is functional.

The restore process includes retry logic with exponential backoff (3 attempts with 5s, 15s, 45s delays), and creates recovery markers if restoration fails so the next boot attempt will retry.

What Gets Backed Up

· Critical tables (synced frequently): wp_posts, wp_postmeta, wp_users, wp_options, wp_usermeta

· Transaction tables (synced every 30 seconds): WooCommerce orders, subscriptions, customers

· Files: WordPress core, plugins, themes, uploads (chunked and compressed)

· Configuration: wp-config.php settings, site metadata

All backups are encrypted before upload to the canister.

Other Features

Sub-Second Cached Page Delivery

The wp_site canister caches HTML pages and serves them directly from the Internet Computer. Cached pages return in approximately 200ms globally, compared to 2-5 seconds when making HTTP outcalls to the backend on every request.

Internet Identity Authentication (Passwordless Admin)

WordPress admin access uses Internet Identity. On production domains, II authentication is automatically enforced, meaning traditional username/password login is blocked.

All WordPress Edits Require Internet Identity

Content editing, plugin management, and all wp-admin actions require a valid Internet Identity session. This is enforced at the code level on production networks. Password-based admin login is completely disabled.

Form Queue Persistence

Contact form submissions are queued in the canister if the backend is temporarily unavailable. Forms persist on-chain with retry logic (up to 5 attempts) until successfully delivered. No lost leads during outages.

Tamperproof Cached Content

Pages served from the canister cache cannot be modified without going through ICP consensus. Even if the TEE SERVER backend is compromised, cached public content remains intact on the blockchain.

Who Is This For?

· Anyone who has lost a WordPress site to server failure and never wants that again

· E-commerce sites that cannot afford to lose orders during outages

· Content publishers wanting fast, globally-distributed delivery

· Security-conscious organizations requiring passwordless admin access

Current Status

Core features (auto-restore, continuous backup, caching, II auth, form queue, circuit breaker failover) are fully implemented.

Beta

We’re currently opening access to about ten to twenty testers, and we’ll gradually increase the pace. Please head to https://www.wasptech.cloud/waitlist and tell us why we should select you We should start testing in the next couple of days.

You can also visit to https://www.wasptech.cloud for more info. (Running on WASP :D)

[jokerswild]

Good temporary pivot to transition to a more modern web with II and all it has to offer.

Could you please repeat what would be needed to be able to run WordPress completely in a canister? You said something about the instruction limit per round right? Is it even possible on a future roadmap to increase this enough without causing issues on the network or will this require even more powerful Gen 3 nodes?

[miadey]

@jokerswild

instruction limit per round right

This is the road block for now. We need at least 200B cycles to be able to open a single page. Wordpress and other PHP framework like Laravel are voracious.

[jokerswild]

Oh that’s correct, we’re at 5B and 40B design limits currently. I’m sure these were not arbitrary limits for the IC with current hardware.

I guess this makes us realize how inefficient and bloated WordPress has truly become over time?

Best of luck with the testing!

This is extremely interesting, e.g. utilizing the ICP network indirectly as a failover for traditional cloud for “mission critical” type business systems where outages end up costing a fortune.

My question to you is, how can you market this in a way for it to be easily distributed? Is it possible to make a deal with traditional cloud providers to add such a service for their web hosting customers who may want to purchase such a solution? Obviously they would receive a cut but is this how this will be sold? Otherwise, you’d have to go door-to-door and provide this to each interested party on a case-by-case basis? This would require manual setup and separate payment for each client right? It could not be automated on a larger scale in this case?

[gstohl]

My 2 cents here:

I do not think wordpress will survive the age of AI

[jokerswild]

Why exactly do you think this Dom?

[gstohl]

made for humans to admin
resource hungry for what it does
gut feeling

I’ve set a reminder in 2 years to check again

[miadey]

I’m with you on this, but it’s not going to happen overnight. You can’t replace millions of WordPress/PHP developers and designers in the short term, and you’re not going to suddenly migrate or shut down the millions of sites (more than 500M) and apps running on WordPress, Drupal, TYPO3, or Laravel. Wordpress may not be the future, but it’s definitely not the past either.

[gstohl]

My 3rd cent: I really like the approach for backups on ICP! I took notes maybe gonna cook smth up later.

[jokerswild]

@miadey

I’m with you on this, but it’s not going to happen overnight. You can’t replace millions of WordPress/PHP developers and designers in the short term, and you’re not going to suddenly migrate or shut down the millions of sites (more than 500M) and apps running on WordPress, Drupal, TYPO3, or Laravel. Wordpress may not be the future, but it’s definitely not the past either.

More than 500 million. That’s hard to believe. Correct.

[miadey]

Many sources confirm this. This one is a great read.

WordPress Market Share, Statistics, and More

It would’ve been a million sites, and I still would’ve gone for it.

[jokerswild]

No of course I believe you.

If anything, it would behoove DFINITY to put in some effort here with you to allow this to happen for these web2 CMS’s to come here esp. WordPress. We need lots of sites hosted here including e-commerce store sites many of which were written in php.

This is a GOOD STRATEGY to start tapping into this market and convince people to migrate their wordpress sites over here for the value added benefits of hosting on the IC of which there are many.

“UPGRADE” to ICP should be a thing. That’s how we start gaining the traffic we need one site at a time. People coming here for content and to transact.

The one thing we’re missing here is this type of Compatibility to make it literally turnkey easy to come here for small as well as large enterprises wanting to take advantage of the new internet of value without having to spend development capital they already spent plus time to rewrite everything from scratch.

Once we have them here, then hopefully ICP devs get hired to get them to the next level.

Anyways, I 10,000% support your project and vision here. We should already be doing this.

[jokerswild]

What should they call it then instead? WordPress ASP?

[gstohl]

seems to me some at dfinity are more focused on some dreamy AI stuff that AI will rule everything and then will use ICP - if AI get so strong it probably will just build its own confidential onchain compute because the AI can reason, research and build its own thing which covers full feature set, but we have some way to go until then they should support every dApp that connects to web2!

[ZackDS]

@GTOneuron

we need to have a “real talk” moment

Who is this we you keep referencing ? The name is fine everyone will think of wasm and wp.
Good prompting skills none the less.

[ZackDS]

@gstohl

some dreamy AI stuff

I just asked "Can you build a WordPress website ? "
It went ahead and did what it wanted instead of saying No.

in case anyone doubted the outcome

So yeah we need WASP.

This is what it considers WP “Style”

[jokerswild]

I asked Caffeine to build me the perfect woman.

Response: “Ha. You are very funny! Good Luck!”

[ZackDS]

Well that makes sense, it doesn’t know what perfect is for you. Motoko is not suitable to build Harley Quinn yet.

[jokerswild]

@ZackDS

Harley Quinn

Or because no such woman exists in our universe…

[jokerswild]

@gstohl

seems to me some at dfinity are more focused on some dreamy AI stuff that AI will rule everything and then will use ICP - if AI get so strong it probably will just build its own confidential onchain compute because the AI can reason, research and build its own thing which covers full feature set, but we have some way to go until then they should support every dApp that connects to web2!

I think Caffeine is a worthy project but a simple strategy like this to truly find a way to migrate web2 properties over to ICP could possibly be transformational in terms of usage and burn and adoption and recognition of what ICP has to offer.

DOM has already expressed interest in WASP for a reason. He understands that this could really help esp. if we can find a way to support such usage on the network even if only on certain subnets.

I think Michel has a really great idea here and he would be adding serious value to this network so we should be taking him very seriously for what he has already accomplished here and is ultimately trying to accomplish. If we can obtain even a small fraction of this marketshare, it would be significant to the bottom line.

It also aligns 100% with the core Mission statement of ICP which is to offer “crypto cloud” services as an alternative or in addition to big tech cloud services.