Permanent Plugin Theme Downloader
A private repository that generates secure permalinks to zip downloads of installed themes and plugins that remain updated.
by Vikas Pandey, The Spiritual Agency · github.com/meditatingsurgeon/permanent-plugin-theme-downloader
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/meditatingsurgeon/permanent-plugin-theme-downloader/archive/refs/heads/main.zip
permanent-plugin-theme-downloader
Permanent Plugins and Theme Downloader
Contributors: The Spiritual Agency Tags: block, plugins, themes, download, share, deployment, spiritual agency Requires at least: 6.1 Tested up to: 6.8 Stable tag: 0.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html
Generate permanent, shareable download URLs for installed plugins and themes with secure token-based authentication that bypasses basic auth.
Description
The Permanent Plugins and Theme Downloader, developed by The Spiritual Agency, provides a robust solution for managing extension accessibility. The plugin creates physical ZIP archives of your installed WordPress plugins and themes, stored in wp-content/pptd-downloads/.
These archives are automatically maintained and served via secure, permanent URLs that remain functional even if your site is behind a firewall or basic authentication.
Key Features:
- Token-Based Security: Secure download URLs with embedded authentication tokens that bypass basic auth
- Zero Configuration: Automatic setup - no manual configuration required
- Physical ZIP Storage: All plugin and theme ZIPs are stored in wp-content/pptd-downloads/
- Permanent URLs: Secure links that never change and always point to the latest version
- Auto-Update Support: ZIP files automatically regenerate when plugins or themes are updated
- Basic Auth Bypass: Download URLs work even when your site requires basic authentication
- Easy Sharing: One-click copy-to-clipboard functionality in the editor
- Clean Interface: List view of all installed plugins and themes with their download URLs
- Frontend Downloads: Clickable links that trigger immediate ZIP file downloads
- Automatic Management: ZIPs regenerate on plugin/theme activation, deactivation, and updates
Installation
- Upload the plugin files to the /wp-content/plugins/permanent-plugin-theme-downloader directory.
- Activate the plugin through the Plugins screen in WordPress.
- The plugin automatically creates the storage directory, generates a secure secret key, and builds the initial ZIP files.
- Add the Permanent Plugins and Theme Downloader block to any post or page.
Frequently Asked Questions
How does this work with basic authentication?
The plugin uses a custom download endpoint with token-based authentication that completely bypasses basic auth. When someone accesses a download URL, the token is validated server-side without requiring basic auth credentials.
What are the permanent URLs?
Each plugin and theme gets a unique URL tied to its slug and a cryptographically secure token. These tokens are permanent for each file.
Do I need to configure anything?
No. The plugin automatically generates a secure secret key on activation and handles all token generation. There is no manual configuration needed.
What happens when I update a plugin or theme?
The ZIP file is automatically regenerated with the new version. The URL and token stay exactly the same, so shared links continue to work.
Are the tokens secure?
Yes. Tokens are generated using HMAC-SHA256 with a 64-character random secret key. They cannot be forged or guessed.
Is this secure?
Yes. The plugin includes HMAC-SHA256 tokens, automatic secret key generation, sanitized file names to prevent directory traversal, path validation, and .htaccess protection.
What if I deactivate the plugin?
The ZIP files in wp-content/pptd-downloads/ are automatically cleaned up when you deactivate the plugin. The secret key remains stored in your database.
Changelog
0.1.0
- Initial release under The Spiritual Agency branding
- Token-based authentication system
- Automatic ZIP regeneration and storage
- Basic authentication bypass support
- HMAC-SHA256 security implementation
Security
This plugin implements multiple security layers:
- Generates HMAC-SHA256 tokens with a 64-character random secret key
- Validates all tokens cryptographically before allowing downloads
- Verifies file paths to prevent unauthorized access
- Sanitizes file names to prevent injection attacks
- Protects download directory with .htaccess
- Only allows .zip file downloads