WP Manifestindependent plugin directory
manifest / multisite / extrachill-search

ExtraChill Search WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

WordPress multisite search functionality for the Extra Chill network.

★ 0stars
664release downloads
≈10active sites
v0.3.8latest · 1mo ago

Install

Download extrachill-search.zip From the v0.3.8 release on GitHub, Sep 22, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/extra-chill/extrachill-search/releases/download/v0.3.8/extrachill-search.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Network-activated WordPress plugin providing universal multisite search functionality for the Extra Chill Platform. Searches across all sites in a WordPress multisite network and displays unified results.

Features

  • Universal Multisite Search - Search all network sites or specific sites with a single function call
  • Per-Site Scope (default) - Front-end searches default to the current site; a "This site / Entire network" toggle lets users opt into network-wide results
  • Canonical Site Map - Sites resolved from ec_get_domain_map() (extrachill-multisite), not get_sites() discovery
  • Flexible Post Type Support - Searches all public post types (posts, pages, custom post types, bbPress topics/replies)
  • Advanced Filtering - Full WP_Query parameter support including meta queries
  • Relevance Scoring - Weighted algorithm prioritizing exact matches, phrase matches, and word-level matching
  • Contextual Excerpts - Generates search-term-centered excerpts with highlighted matches
  • Cross-Site Pagination - Results sorted chronologically across all sites with 404 fix for paginated queries
  • Pagination 404 Fix - Automatically resolves WordPress 404 errors on paginated search across network sites
  • Site Badges - Visual indicators showing which site each result originates from

Requirements

  • WordPress: 5.0+
  • PHP: 7.4+
  • Multisite: WordPress multisite installation required
  • Theme: ExtraChill theme (for template integration)

Build + deployment

Build the production ZIP with ./build.sh (symlinked to /.github/build.sh).

Deployments and remote operations run through Homeboy (homeboy/ in this repo).

The build artifact is build/extrachill-search.zip.

Usage

Search All Sites

// Basic search
$results = extrachill_multisite_search( 'search term' );

// Search returns array of post objects with site metadata
foreach ( $results as $result ) {
    echo $result['post_title'];      // Post title
    echo $result['site_name'];       // Site name
    echo $result['permalink'];       // Full URL to post
}

Search Specific Sites

$results = extrachill_multisite_search(
    'search term',
    array( 'community.extrachill.com', 'extrachill.com' )
);

Advanced Search with Filters

$results = extrachill_multisite_search(
    'search term',
    array(),  // Empty array = all sites
    array(
        'limit'       => 20,
        'offset'      => 0,
        'post_status' => array( 'publish' ),
        'orderby'     => 'date',
        'order'       => 'DESC',
        'meta_query'  => array(
            array(
                'key'     => '_bbp_forum_id',
                'value'   => '1494',
                'compare' => '!=',
            ),
        ),
    )
);

Template Functions

// Get paginated search results with total count
list( $results, $total ) = extrachill_get_search_results( $_GET['s'], $page, $per_page );

// Generate pagination UI
extrachill_search_pagination( $total, $per_page, $page, $_GET['s'] );

// Get contextual excerpt with search term highlighted
$excerpt = ec_get_contextual_excerpt_multisite( $post_content, $search_term, 300 );

Architecture

Network Sites Covered

The plugin searches across all sites in your WordPress multisite network. In the Extra Chill Platform, this includes all 10 active sites:

  1. extrachill.com - Main site (Blog ID 1)
  2. community.extrachill.com - Forums (Blog ID 2)
  3. shop.extrachill.com - E-commerce (Blog ID 3)
  4. artist.extrachill.com - Artist platform (Blog ID 4)
  5. events.extrachill.com - Events calendar (Blog ID 7)
  6. newsletter.extrachill.com - Newsletter (Blog ID 9)
  7. docs.extrachill.com - Documentation (Blog ID 10)
  8. wire.extrachill.com - News wire (Blog ID 11)
  9. studio.extrachill.com - Studio / team workspace (Blog ID 12)

(Blog ID 8 / stream.extrachill.com was decommissioned in April 2026.)

Search Result Structure

array(
    'ID'           => 123,                    // Post ID
    'post_title'   => 'Post Title',           // Post title
    'post_content' => 'Full content...',      // Full content
    'post_excerpt' => 'Excerpt...',           // Excerpt
    'post_date'    => '2025-10-07 12:00:00',  // Publication date
    'post_type'    => 'post',                 // Post type
    'post_name'    => 'post-slug',            // Post slug
    'post_author'  => 1,                      // Author ID
    'site_id'      => 1,                      // Blog ID
    'site_name'    => 'Extra Chill',          // Site name
    'site_url'     => 'extrachill.com',       // Site URL
    'permalink'    => 'https://...',          // Full post URL
    'taxonomies'   => array(                  // Taxonomy terms
        'category' => array( 'term_name' => term_id ),
    ),
)

Performance Optimizations

  • Static Caching - Network sites cached in memory
  • WordPress Blog-ID-Cache - Automatic blog ID caching for optimal performance
  • Efficient Blog Switching - Minimal context switching with proper error handling
  • Relevance Scoring - Weighted algorithm sorts results by match quality before pagination
  • Cross-Site Date Sorting - Results sorted chronologically across all sites

Pagination Architecture

WordPress native search only checks the current site for results. When paginating multisite search results, if the current site has no matching posts on a given page, WordPress returns 404 even though other network sites may have results.

The plugin intercepts these 404 errors via the template_redirect hook, queries all network sites to verify results exist, and overrides the 404 status when multisite results are found. This ensures pagination works correctly across all network sites.

Theme Integration

Required Theme Functions

The plugin expects your theme to provide:

  • extrachill_breadcrumbs() - Breadcrumb navigation
  • extrachill_no_results() - No results message
  • extrachill_display_taxonomy_badges() - Taxonomy badge display
  • inc/archives/post-card.php - Post card template

Action Hooks Used

  • extrachill_before_body_content - Before main content area
  • extrachill_after_body_content - After main content area
  • extrachill_search_header - Search results header area
  • extrachill_archive_below_description - Below archive description
  • extrachill_archive_above_posts - Above posts loop

Template Override Filter

The plugin uses the ExtraChill theme's template routing filter:

add_filter( 'extrachill_template_search', array( $this, 'override_search_template' ), 10 );

This integrates with the theme's universal template routing system located in inc/core/template-router.php.

File Structure

extrachill-search/
├── extrachill-search.php           # Main plugin file
├── inc/
│   ├── core/
│   │   ├── search-functions.php    # Core multisite search functionality
│   │   └── taxonomy-functions.php  # Taxonomy helpers
│   └── templates/
│       ├── template-functions.php  # Template helper functions
│       └── site-badge.php          # Site badge display component
├── templates/
│   └── search.php                  # Search results template
├── build.sh                        # Production build script
├── .buildignore                    # Build exclusions
├── CLAUDE.md                       # Developer documentation
└── README.md                       # This file

Development

Build Production Package

# Create production ZIP file
./build.sh

# Output: Only /build/extrachill-search.zip file

Development Commands

# Check PHP syntax
php -l extrachill-search.php

# Test search function (requires WordPress environment)
wp eval 'print_r(extrachill_multisite_search("test"));'

Support

Author

Chris Huber

License

GPL v2 or later

Releases

9 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.3.8 latest
Sep 22, 2026 1mo ago
extrachill-search.zip
622
Sep 21, 2026 1mo ago
extrachill-search.zip
8
Aug 23, 2026 2mo ago
extrachill-search.zip
19
Aug 23, 2026 2mo ago
extrachill-search.zip
2
Aug 23, 2026 2mo ago
extrachill-search.zip
2
Jul 12, 2026 3mo ago
extrachill-search.zip +1 asset
7
extrachill-search.zip0
01-extrachill-search.zip7
Jun 22, 2026 4mo ago
extrachill-search.zip
1
Jun 15, 2026 4mo ago
extrachill-search.zip
1
Jun 3, 2026 4mo ago
extrachill-search.zip
2

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

ExtraChill Search 0.3.8 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.3.8
Findings
1
Worst severity
medium
Content hash
228c89db6e9e7b841f8c5ac2…

Findings

  • medium Subscriber can read unpublished posts network-wide via multisite-search ability post_status argument

    information_disclosure

    extrachill_register_abilities() registers the multisite-search ability with show_in_rest and permission_callback current_user_can('read'), and accepts a caller-supplied post_status array. extrachill_ability_multisite_search() forwards it unchecked to extrachill_network_search(), which switch_to_blog()s every site and runs WP_Query with that post_status (no 'perm' => 'readable'), then returns post_title, post_content (get_the_content) and excerpt. Any logged-in subscriber can therefore retrieve drafts, pending, scheduled and private posts from all sites in the network.

    inc/core/abilities.php:59-64, 133-136, 150-189

    Recommendation

    Force post_status to 'publish' for callers lacking edit_others_posts/read_private_posts on each target site (or add 'perm' => 'readable' to the WP_Query), and restrict the input schema enum to publish.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.