WP Manifestindependent plugin directory

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pomeg-dev/nextpress/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WP Vercel Deploy Hooks

A WordPress plugin to deploy a static site to Vercel when you publish a new WordPress post/page, update a WordPress post/page or deploy on command from the WordPress admin menu and admin bar.

Based on the excellent WordPress Plugin WP Netlify Webhook Deploy.

✅ Features

  • 🚗   Deploy your Vercel project when publishing / updating a WordPress post
  • 👉   Manually deploy your Vercel Project with the push of a button
  • ⏲   Schedule deploys on a daily or weekly basis (mileage may vary).

🛠 Installation

You can install WP Vercel Deploy Hooks manually or through Composer

🤙 Manual Install

  1. Download the plugin as a .zip file from the repository
  2. Login to your WordPress site and go to Plugins -> Add new -> Upload plugin
  3. Locate the .zip file on your machine, upload and activate

🎼 Composer

Composer allows you to install pacakges from a GitHub repository. This repository includes a composer.json file which declares the package as a WordPress plugin. Include it in your project's composer.json as following:

...
  "repositories": [
    {
      "type": "vcs",
      "url": "https://github.com/aderaaij/wp-vercel-deploy-hooks.git"
    }
  ],
  "require": {
    "aderaaij/wp-vercel-deploy-hooks": "main"
  }
...

Now the package will be included in the plugins folder when you use composer install/update.

⚙️ Settings / Configuration

To enable the plugin, you will need to create a Deploy Hook for your Vercel Project.

🎚 Settings

After you've created your deploy hook, navigate to Deploy -> Settings in the WordPress admin menu and paste your Vercel Deploy hook URL. On the settings page you can also activate deploys when you publish or update a post (disabled by default).

You can configure the Vercel Deploy Hook URL in your wp-config.php or other configuration file to be based on your environment using the constant WP_VERCEL_WEBHOOK_ADDRESS. An example follows:

switch (WP_ENVIRONMENT_TYPE) {
    case "live":
    case "production":
        define( 'WP_VERCEL_WEBHOOK_ADDRESS', 'https://api.vercel.com/v1/integrations/deploy/<sample>/<sample>' );
        break;

    case "test":
    case "staging":
        define( 'WP_VERCEL_WEBHOOK_ADDRESS', 'https://api.vercel.com/v1/integrations/deploy/<sample>/<sample>' );
        break;

    case "dev":
    case "development":
        define( 'WP_VERCEL_WEBHOOK_ADDRESS', 'https://api.vercel.com/v1/integrations/deploy/<sample>/<sample>' );
        break;

    case "local":
        define( 'WP_VERCEL_WEBHOOK_ADDRESS', 'https://api.vercel.com/v1/integrations/deploy/<sample>/<sample>' );
        break;
}

See https://make.wordpress.org/core/2020/07/24/new-wp_get_environment_type-function-in-wordpress-5-5/ for more guidance on using WP_ENVIRONMENT_TYPE

⏲ Scheduling

When you enable scheduling it calls the cron_schedules hook which depends on your site having visitors to be triggered. To make sure your schedule is triggered timely, you could schedule a CRON job in your hosting panel which calls wp-cron.php. Please check out the Webhook Netlify Deploy scheduling documentation for more information.

👯 Contributors & Credits

This plugin was based on the excellent WordPress Plugin WP Netlify Webhook Deploy

Made with contrib.rocks.

🤔 To Do

  • Add support for deploy and build statusses and updates through the Vercel API
  • Add support for Netlify Builds and Deploys
  • Add support for multiple Vercel deploy endpoints

Releases

3 releases.

Tag
Published
2.02 latest
May 6, 2025 1 year ago
May 6, 2025 1 year ago
May 6, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Nextpress 2.02 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
2.02
Findings
2
Worst severity
high
Content hash
9c6938ae265f7c9d45125317…

Findings

  • high Router REST leaks draft/private/pending posts by slug

    information_disclosure

    GET /nextpress/router has no permission_callback. When path lookup fails, get_post_by_path() queries post_status including draft, pending, private, future, revision by name/slug and returns the post payload — unpublished content disclosure to unauthenticated clients.

    class/api/api-router.php:34-79

  • medium Auth REST routes intentionally public but forgot-password enumerates users

    information_disclosure

    Login/register/reset/logout use permission_callback __return_true (expected for headless auth). forgot_password_callback returns distinct 'User not found' vs success, enabling email/login enumeration. CSRF logout via GET /nextpress/logout lacks nonce.

    class/user-flow/user-flow.php:251-287

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.