Install
Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/ashawkat/plugsent-connector/releases/download/v0.13.0/plugsent-connector-0.13.0.zip
Plugsent Connector
The site-side half of Plugsent — the self-hosted, open-source fleet manager for WordPress.
This plugin connects a WordPress site to your self-hosted Plugsent control plane. Once paired, the site checks in every minute over an outbound, HMAC-signed channel — it reports its full plugin/theme/core inventory, executes commands your team sends from the Plugsent dashboard (updates, safe updates, management actions, admin login, security scans and hardening), and runs scheduled uptime piggyback checks.
No inbound ports. No firewall rules. No WordPress admin passwords — ever.
How it works
Your Plugsent server This WordPress site
▲ │
│ 1. paste pairing code (one-time) │
│ 2. receive site key + secret │
│ 3. signed long-poll every minute ►
◄──────── signed results ────────────┘- In the Plugsent dashboard, open Connect site and register the site — you get a pairing code valid for 15 minutes, single use.
- Install this plugin, open Settings → Plugsent Connector, paste the Server URL and the pairing code.
- The plugin exchanges the code for a per-site key + secret and starts its check-in loop. The site flips to Connected in the dashboard automatically.
Every request is signed with HMAC-SHA256 over "{timestamp}.{body}", carries a fresh nonce
(replay protection), and commands expire if unanswered. Revoke a site from the dashboard and
its credentials die on the next poll.
Commands supported (v0.13)
| Command | Purpose |
|---|---|
inventory.get |
Full core/plugin/theme inventory with update availability |
update.run |
Plain update of a plugin, theme, or WordPress core |
update.safe |
Safe-update pipeline: files + streamed DB-dump restore point → update → site smoke test → automatic rollback if the site misbehaves; 14-day retention, three restore points per item |
restore.apply |
Manual rollback to the restore point taken before the last update |
plugin.activate / plugin.deactivate / plugin.delete |
Plugin management |
theme.activate / theme.delete |
Theme management |
admin.login |
Single-use magic login URL for the paired administrator (300 s TTL, hash stored — never the token) |
security.scan |
Read-only security facts: WP_DEBUG, SSL, XML-RPC state, DISALLOW_FILE_EDIT, blog_public, inactive plugin/theme counts, current hardening state |
security.harden |
Enable/disable one of six persisted hardening protections (see below) |
| — anything else | Reported back as unsupported_command so the platform knows |
The plugin advertises its capability list on every check-in; the dashboard uses it to show only the actions your connector version supports — a newer dashboard never breaks an older plugin.
Hardening protections (v0.13)
Toggled per site from the Plugsent dashboard, persisted in the plugsent_hardening option
(DB-backed, survives restarts), and (re-)applied on every request:
| Protection | What it does |
|---|---|
| Hide your WordPress version | Removes the generator meta/feeds so version-specific exploits can't be targeted |
| Block user enumeration | Redirects ?author=N scans for logged-out visitors and removes public /wp/v2/users REST routes |
| Mask login error messages | One generic message on failed logins, so usernames can't be probed |
| Disable the file editor | DISALLOW_FILE_EDIT — a compromised admin can't inject PHP from wp-admin |
| Add security headers | X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy |
| Disable XML-RPC | Closes the endpoint commonly abused for brute-force and pingback attacks |
Safe updates
update.safe is the flagship: before touching anything it takes a restore point (zipped
files + streamed database dump), then updates, then runs a smoke test against the live
site. If the site stops answering correctly, everything rolls back automatically. Restore
points are retained for 14 days (three per item) and a manual restore.apply can roll any
update back from the dashboard.
What it reports (and what it never does)
Sent to your Plugsent server: site name and URL, WordPress and PHP versions, the
plugin/theme inventory (name, version, active state, available updates), security facts from
security.scan, and command results (including update/rollback outcomes).
Never touched: your posts, users, comments, or content — and your WordPress admin password is not asked for at any point. Login tokens are single-use, hashed at rest, and expire in 5 minutes.
Requirements
- WordPress 6.0+
- PHP 7.4+
- A reachable Plugsent server (HTTPS strongly recommended — pairing sends the site's secret once, over that connection)
Installation
- Grab the latest release ZIP from the
Releases page (e.g.
plugsent-connector-0.13.0.zip). - In wp-admin: Plugins → Add New → Upload Plugin, choose the ZIP, replace/activate.
- Go to Settings → Plugsent Connector and pair using the dashboard instructions above.
Pairing data survives updates — upgrading never requires re-pairing.
Not yet listed on wordpress.org — install from source for now. The repo already ships the directory assets (
icon.svg, banners) and a directory-formatreadme.txt, so it's ready for submission.
Development notes
- The signer (
includes/class-plugsent-signer.php) is a vendored copy ofplugsent/connector-signingfrom the main repo. Both implementations run against the same test vectors in the platform's CI, so they can never silently drift. - The static Plugin Check audit (nonces, capability checks, sanitization, escaping, text
domain, readme sections) runs with the platform's suite in
tests/Feature/PluginCheckCompatibilityTest.php. - Uninstall removes all plugin options (pairing, hardening state) and the scheduled check-in.
Changelog (highlights)
- 0.13.0 —
security.scanfacts +security.hardensix persisted protections - 0.12.0 — safe-update pipeline: restore point, smoke test, automatic rollback,
restore.apply - 0.11.x — plugin/theme management actions; delete fix; fatal-guarded command reporting
- 0.10.0 — DB-backed login tokens (object-cache-proof)
- 0.9.0 — working
admin.logindispatch - 0.8.0 — opt-in long-polling + version/capability reporting
- 0.7.0 — admin quick login
- 0.5.0 — connection-string pairing
Security
Found a vulnerability? Please use GitHub's Report a vulnerability (Security tab) on this repository rather than a public issue.
License
- Plugin code: GPL-2.0-or-later — as WordPress plugins must be.
- Bundled Google Sans font files: © Google, under the SIL Open Font License 1.1.
Releases
15 releases. Each count is every asset in that release; expand a row for the breakdown.