SGP Updater WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

Keeps an SGP-built WordPress theme updated from its GitHub repository, using WordPress's own update flow. Updates appear under Dashboard → Updates and Appearance → Themes exactly like any other theme update — there is no separate interface to learn.

Built so SGP can deploy client sites from GitHub without uploading zip files by hand, and without a per-site or per-year licence.

How it works

The plugin reads a GitHub Theme URI header from the active theme's style.css:

GitHub Theme URI: https://github.com/SGP-Design/example-website

It then watches the main branch of that repository. Whenever the Version: header there is higher than the installed version, WordPress offers an update.

So the release process is: bump Version: in style.css, commit, push. Nothing else.

The header name is deliberately the same one Git Updater uses, so a site can be moved between the two without editing the theme.

The plugin also keeps itself updated from SGP-Design/sgp-updater the same way.

Installation

1. Download this repository as a zip
2. Plugins → Add New → Upload Plugin, then activate
3. Settings → SGP Updates, and paste a GitHub access token

The token is only needed for private repositories. It needs read access to the theme repository and nothing else.

Storing the token outside the database

If wp-config.php can be edited, prefer:

define( 'SGP_GITHUB_TOKEN', 'ghp_your_token_here' );

A constant keeps the token out of the database, so a database export doesn't leak it. The plugin prefers the constant when both are present, and hides the settings field.

The settings screen

Settings → SGP Updates reports the active theme and version, the repository it found, and whether it can actually reach that repository. The connection line distinguishes the failures that look identical from the outside:

What it does not touch

Only the theme directory, and only through WordPress's own updater. The database is never involved, so pages, media, menus, settings, and form submissions are unaffected by an update.

Because an update replaces the whole theme directory, anything edited directly on the server — through WordPress's built-in file editor, or over FTP — is overwritten on the next update. The repository has to be the only place changes are made.

Credits

The update mechanism is plugin-update-checker by Yahnis Elsts (MIT), vendored in plugin-update-checker/. This plugin is the configuration around it.

Requirements

WordPress 6.0+, PHP 8.0+.

Why this repository is public

The plugin updates itself from this repository. If it were private, every client site would need a token that could read it - which would mean a credential installed on a client's WordPress install granting access to an SGP-internal repository, purely so the plugin could patch itself.

Public inverts that. The plugin self-updates with no credential at all, and the token a client site holds is scoped to that client's own theme repository and nothing else. There is nothing proprietary here: the plugin is configuration around plugin-update-checker (MIT, vendored).

Client themes stay private. This is the tool, not the work.