Two bugs found:
1. wp-config-docker.php was being copied to /usr/src/wordpress/wp-config-docker.php,
REPLACING the official WordPress config template. Our file only had security
hardening settings (DISALLOW_FILE_EDIT, etc.) but no DB constants, auth keys,
or table prefix. The generated wp-config.php had zero database configuration,
so WordPress could never connect.
Fix: Copy our config to /usr/src/websitebox-config.php instead, and load it
via WORDPRESS_CONFIG_EXTRA=require_once in docker-compose.yml.
2. .user.ini set auto_prepend_file=wordfence-waf.php, but the file didn't exist
until Wordfence plugin was installed. Every PHP request during initial setup
returned a 500 fatal error.
Fix: Add a stub wordfence-waf.php placeholder in the Docker image that gets
copied with WordPress files. Wordfence replaces it during plugin activation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>