v2026.10.27.01 — 2026-10-27

Improvements

• Block direct wp-config.php access on subdomains like main vhost
• Block direct wp-settings.php/wp-load.php access like wp-config.php
• UpstreamAntispam fully bypasses rspamd via want_spam, wire settings.d into config
• Add missing reseller_smtp_key_unreadable/reseller_smtp_fallback/account_migrated/admin_email_changed/monthly_report to all 15 notifications.json