Amixa Redis Zero Touch for WordPress on Windows Server IIS – setup, phpredis and validation scripts

Amixa Redis Zero Touch is designed to give each WordPress site its own isolated Redis ACL identity and namespace without placing a Redis password in wp-config.php and without requiring broad write permission across wp-content.

This article documents the supported Windows Server / IIS workflow and provides the generalized PowerShell and Linux validation scripts we use for deployment.

Support package version: 1.0.0
Package SHA-256: 98223bb7598a3146238d71207445f3d6adef52afa76d2a07a848046a042e8b34

Download the complete Amixa Redis Zero Touch Windows / IIS Support Package
Download SHA-256 manifest

What this support package does

The package contains five generalized deployment/validation tools:

1. Install-AmixaPhpRedisForIIS-v1.0.0.ps1 — discovers the IIS site and PHP FastCGI runtime, finds the matching official Windows PECL phpredis package, backs up PHP configuration, installs phpredis, recycles only the target app pool, and validates both CLI and real IIS/FastCGI PHP.
2. Prepare-AmixaRedisZeroTouchIISSite-v1.0.0.ps1 — creates the protected Redis credential directory with a narrow app-pool ACL and pre-provisions the accepted hardened object-cache loader without making all of wp-content writable.
3. Test-AmixaRedisZeroTouchIISReadiness-v1.0.0.ps1 — performs a non-destructive IIS/FastCGI readiness check using a temporary nonce-protected web probe that is deleted automatically.
4. Test-AmixaRedisZeroTouchDataPlane-v1.0.0.ps1 — proves real persistent WordPress object-cache behavior across four independent PHP processes: SET, fresh GET, DELETE, and a fresh post-delete GET.
5. Test-AmixaRedisZeroTouchControlPlane-v1.0.0.sh — performs a secret-safe Redis Zero Touch server-side check of Enrollment API state, Redis auth health, ACL/control identity, drift, and handoff cleanup.

Security model

The hardened IIS deployment deliberately keeps the site’s normal WordPress content directory read-only to the PHP application-pool identity. The preparation script grants Modify permission only to:

wp-content.amixa-redis-zero-touch

The site’s IIS application-pool identity receives Modify on that protected directory. SYSTEM and the local Administrators group retain Full Control. The parent wp-content ACL is recorded before the change and must remain byte-for-byte equivalent in SDDL after preparation.

A small hash-pinned object-cache.php loader is placed directly in wp-content. It remains inert until Zero Touch enrollment has completed, delivery has been acknowledged, and persistent caching is enabled. This avoids granting broad Modify permission to wp-content simply so WordPress can install a cache drop-in.

The accepted component hashes for this support release are:

Hardened IIS loader
bc7923a08662ae2dddbc06775e82bf76aefc5c8ab33ab6c5399e555861d33eb9

Accepted WordPress object-cache runtime
197b11420ea2b1b0a4d66b38bc5e8e9662421c3fdc967489deaadc38c9944678

Step 1: install and activate the WordPress plugin

Install the Amixa Redis Zero Touch plugin through the normal WordPress interface:

WordPress Admin -> Plugins -> Add Plugin -> Upload Plugin

Activation and Redis enrollment are intentionally separate. Plugin activation should not provision a Redis identity, request a credential, or activate the persistent object cache.

After activation, go to:

Tools -> Redis Zero Touch

The Setup Assistant checks PHP, OpenSSL, phpredis, DNS discovery, Enrollment CA integrity, Enrollment API HTTPS transport, canonical site identity, the WordPress callback contract, protected credential storage, and the persistent-cache activation path.

Do not click Enroll This Site until every Setup Assistant item is green.

Step 2: install phpredis if the Setup Assistant reports it missing

PHP for Windows recommends Non-Thread-Safe PHP when PHP is used as FastCGI under IIS. The official PECL Redis package publishes matching Windows DLL builds for supported PHP versions, architectures, and TS/NTS models.

Run PowerShell as Administrator and preview the phpredis operation first:

.Install-AmixaPhpRedisForIIS-v1.0.0.ps1 -HostName www.example.com

If the discovery and plan are correct, apply it:

.Install-AmixaPhpRedisForIIS-v1.0.0.ps1 -HostName www.example.com -Apply

The script resolves the site’s effective PHP FastCGI runtime from IIS, reads the actual PHP version/architecture/thread model, then selects exactly one matching package from the official PHP Windows PECL Redis directory. It does not use third-party DLL mirrors.

The installer backs up php.ini and any existing php_redis.dll before making changes. It validates phpredis using a temporary PHP CLI script, recycles only the target IIS app pool, and then validates the real IIS/FastCGI web runtime. A failed validation triggers rollback.

If PHP reports that php_redis.dll cannot be loaded even though the file exists, verify that the current Microsoft Visual C++ v14 runtime is installed and that the downloaded PECL build exactly matches the PHP major/minor version, TS/NTS model, and x86/x64 architecture.

Step 3: prepare hardened credential storage and the object-cache loader

Preview:

.Prepare-AmixaRedisZeroTouchIISSite-v1.0.0.ps1 -HostName www.example.com

Apply:

.Prepare-AmixaRedisZeroTouchIISSite-v1.0.0.ps1 -HostName www.example.com -Apply

The only required site-specific argument is the hostname. The script discovers the IIS site, physical WordPress root, application pool, PHP FastCGI runtime, WP_CONTENT_DIR, and WP_PLUGIN_DIR.

It stops instead of overwriting a foreign object-cache.php. It also refuses to treat an already-enrolled credential store as a fresh preparation target.

Step 4: re-check the plugin Setup Assistant

Return to Tools -> Redis Zero Touch and click Re-check setup.

A site that is ready for enrollment should show PASS for all of the following:

• PHP version
• OpenSSL extension
• phpredis extension
• PHP DNS SRV/TXT support
• Zero Touch DNS discovery
• Enrollment CA integrity
• Enrollment API HTTPS transport
• Canonical HTTPS site identity
• WordPress callback route contract
• Protected credential storage
• Persistent cache activation path

The current Enrollment API root intentionally has no public index document, so a TLS/HTTP transport check may report an HTTP 404 while still showing PASS. In this check, the important result is that WordPress/PHP completed a certificate-verified HTTPS exchange using the bundled Enrollment CA. A dedicated health endpoint may replace this behavior in a later server release.

Step 5: enroll exactly once

When the Setup Assistant says Ready for enrollment, click Enroll This Site once and let the request finish.

A healthy result should show an acknowledged enrollment, a decryptable local credential store, the site’s non-secret installation ID/ACL username/namespace, generation numbers, the hardened loader, and an active WordPress external object cache.

The Redis password, control token, and pending ACK token are never displayed by the plugin or by the support scripts.

Step 6: use the plugin’s Redis / isolation test

After enrollment, click Test Redis / Isolation. A passing result verifies Redis authentication, read/write/delete access to the site’s own namespace, and isolation from foreign namespaces.

Step 7: independent Windows data-plane validation

For a deployment acceptance test, run:

.Test-AmixaRedisZeroTouchDataPlane-v1.0.0.ps1 -HostName www.example.com

The validator starts four separate PHP processes through the site’s WordPress installation:

1. Process 1 writes a unique temporary cache value.
2. Process 2 is a fresh PHP process and must retrieve the value.
3. Process 3 deletes it.
4. Process 4 is another fresh PHP process and must confirm the value is absent.

This proves that WordPress is using the persistent external Redis backend rather than merely reusing a value from one PHP process’s in-memory cache.

Step 8: optional Redis Zero Touch control-plane validation

On the Redis Zero Touch Linux server:

sudo ./Test-AmixaRedisZeroTouchControlPlane-v1.0.0.sh --site-host www.example.com

For the stricter first-enrollment acceptance test:

sudo ./Test-AmixaRedisZeroTouchControlPlane-v1.0.0.sh --site-host www.example.com --fresh-enrollment

Normal-health mode accepts later healthy credential/control generations after rotation. Fresh-enrollment mode requires generation 1 and the clean first-enrollment state.

The server-side validator intentionally does not print credential handoff contents, Redis passwords, control tokens, or ACK tokens.

Readiness verifier

If you want an IIS-side view before or after enrollment, run:

.Test-AmixaRedisZeroTouchIISReadiness-v1.0.0.ps1 -HostName www.example.com

This script creates a short-lived nonce-protected PHP probe in the site root, calls it through the site’s real IIS/FastCGI handler, and removes it immediately. It reports the actual web runtime’s phpredis/OpenSSL status, protected-store writability, accepted loader/runtime hashes, and WordPress external-cache state. It does not read the contents of the encrypted credential file.

Common problems

phpredis is missing

Run the phpredis installer in preview mode first. Do not simply copy a random php_redis.dll from another PHP installation. The DLL must match the site’s actual PHP major/minor version, architecture, and TS/NTS build.

PHP says the Redis module is already loaded

Check php.ini for duplicate active extension=php_redis.dll lines. The installer stops when it finds more than one active Redis extension directive.

object-cache.php already exists

Do not overwrite it blindly. Another cache plugin may own the drop-in. The hardened preparation script stops when the existing file’s SHA-256 does not match the accepted Amixa loader.

wp-content is not writable

That can be intentional and is the preferred hardened IIS model. Do not grant broad Modify permission to all of wp-content solely for Redis Zero Touch. Use the preparation script to create the narrow protected credential directory and pre-provision the accepted loader.

The WordPress callback check fails

Confirm that the plugin is active, the WordPress REST API is reachable, and security/proxy rules are not blocking the Zero Touch callback route. The Setup Assistant expects the local probe to reach the registered route and receive the plugin-specific missing-challenge response rather than WordPress rest_no_route.

Enrollment failed after the server may have provisioned something

Do not repeatedly click Enroll. Review the plugin status first. The delivery/ACK workflow is designed so interrupted enrollment can be detected and, where supported, resumed without blindly creating another identity.

Removal and revocation are different operations

Removing the local WordPress enrollment does not claim to revoke the server-side Redis identity. Treat local decommission and server-side identity revocation as separate administrative operations.

Download

Download Amixa Redis Zero Touch Windows / IIS Support Package 1.0.0

SHA-256: 98223bb7598a3146238d71207445f3d6adef52afa76d2a07a848046a042e8b34
SHA-256 manifest

Upstream references

• PECL Redis / phpredis
• Official PHP Windows PECL Redis builds
• PHP for Windows
• Microsoft Visual C++ Redistributable
• Older Amixa manual Redis Object Cache setup article

As with any server administration script, review the downloaded source before running it in production. The mutating PowerShell tools default to PREVIEW mode and require -Apply before they change the server.