diff --git a/par-api/src/main/java/com/par/api/controller/ScriptController.java b/par-api/src/main/java/com/par/api/controller/ScriptController.java
index 1358fa3..85e586e 100644
--- a/par-api/src/main/java/com/par/api/controller/ScriptController.java
+++ b/par-api/src/main/java/com/par/api/controller/ScriptController.java
@@ -74,9 +74,15 @@ public class ScriptController {
         if (script == null || script.isBlank()) {
             return ApiResponse.error(400, "script body is required");
         }
-        // 版本号由服务端管理
+        // 版本号递增
+        SiteConfig latest = configService.getLatestConfig(siteId);
+        int nextVersion = 1;
+        if (latest != null) {
+            try { nextVersion = Integer.parseInt(latest.getVersion()) + 1; }
+            catch (NumberFormatException ignored) {}
+        }
         Long submitterId = (Long) request.getAttribute("accountId");
-        SiteConfig config = configService.submitConfig(siteId, "1", script, submitterId);
+        SiteConfig config = configService.submitConfig(siteId, String.valueOf(nextVersion), script, submitterId);
         return ApiResponse.success(Map.of("version", config.getVersion()));
     }
 }
diff --git a/par-core/src/main/java/com/par/core/config/WebConfig.java b/par-core/src/main/java/com/par/core/config/WebConfig.java
index d9449ae..d241dd0 100644
--- a/par-core/src/main/java/com/par/core/config/WebConfig.java
+++ b/par-core/src/main/java/com/par/core/config/WebConfig.java
@@ -34,6 +34,9 @@ public class WebConfig implements WebMvcConfigurer {
         registry.addInterceptor(hmacAuthInterceptor)
                 .addPathPatterns("/api/v1/configs/*/submit", "/api/v1/sites/*/submit",
                         "/api/v1/sites/*/access-result", "/api/v1/sites/*/error-log",
+                        "/api/v1/sites/*/pages",            // PUT 页面配置
+                        "/api/v1/scripts/*",                // PUT 上传脚本
+                        "/api/v1/risk-rules/*",             // POST 提交风险规则
                         "/api/v1/admin/**", "/api/v1/account/**");
     }
 }