WardTech Apps Connector WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

Reports this WordPress site's status — WordPress core version, installed plugins and administrator accounts — to the WardTech central system at https://apps.wardtech.co.uk once a day.

Installation

1. Copy wardtech-apps-connector.php into wp-content/plugins/wardtech-apps-connector/ (or upload the folder as a zip via Plugins → Add New → Upload).
2. Activate WardTech Apps Connector in the Plugins screen. Activation schedules the daily report.
3. Go to Settings → Apps Connector, paste the access token issued by WardTech, and click Save token. The plugin immediately pings the API and confirms with the connected application name.

wp-config.php changes

None are required for the plugin to work out of the box. The token is stored in the database via the settings screen, and no constants need to be defined.

The situations below are the only ones that touch wp-config.php; each depends on how the host is configured — check them if reports are not arriving.

0. Point at a different environment (staging / local)

By default the plugin talks to https://apps.wardtech.co.uk/api. To send a staging or local site elsewhere, define the base URL before WordPress loads the plugin (i.e. in wp-config.php):

define( 'WARDTECH_APPS_BASE_URL', 'http://apps.wardtech.test/api' );

The value must include the /api path and no trailing slash. If the constant is not defined, production is used automatically.

1. Outbound HTTP must be allowed to WardTech

The plugin sends data with wp_remote_post(). If this site defines WP_HTTP_BLOCK_EXTERNAL to block outgoing requests, the report and the token-check ping will silently fail unless apps.wardtech.co.uk is on the allow-list.

If — and only if — your wp-config.php already contains WP_HTTP_BLOCK_EXTERNAL, add the host to WP_ACCESSIBLE_HOSTS:

// Only needed if external HTTP is blocked on this site.
define( 'WP_HTTP_BLOCK_EXTERNAL', true );
define( 'WP_ACCESSIBLE_HOSTS', 'apps.wardtech.co.uk' );
// Append to any existing comma-separated list, e.g.
// define( 'WP_ACCESSIBLE_HOSTS', 'api.example.com,apps.wardtech.co.uk' );

If neither constant is present (the WordPress default), external requests are already allowed and no change is needed.

2. Reliable daily delivery on low-traffic sites (recommended)

The daily report runs on WP-Cron, which only fires when someone visits the site. On a quiet site the report can be late or skipped. For dependable delivery, disable the visitor-triggered cron and drive it from a real system cron instead.

In wp-config.php (above the /* That's all, stop editing! */ line):

define( 'DISABLE_WP_CRON', true );

Then add a server cron entry (e.g. every 15 minutes) that runs WordPress's cron handler:

*/15 * * * * curl -s https://your-site.example/wp-cron.php?doing_wp_cron > /dev/null 2>&1

Or, if WP-CLI is available:

*/15 * * * * cd /path/to/wordpress && wp cron event run --due-now > /dev/null 2>&1

This is optional but recommended for production sites; the plugin works without it on sites that get regular traffic.

Verifying it works

• Settings → Apps Connector shows "This site is connected to WardTech as …" once a valid token is saved.

• To confirm the daily job is scheduled, with WP-CLI:

  wp cron event list | grep wardtech_status_report

• To send a report immediately for testing:

  wp cron event run wardtech_status_report

What it sends

A JSON payload to POST /api/status-report:

{
  "type": "wordpress",
  "core_version": "6.5.2",
  "components": [
    { "name": "Akismet Anti-spam", "version": "5.3", "active": true }
  ],
  "administrators": [
    { "username": "admin", "display_name": "Site Admin" }
  ]
}

Authenticated with Authorization: Bearer <token>. For each administrator account the report includes the username and display name only — no email addresses, passwords, or other personal data, and no post content or credentials are transmitted.

Updates

This plugin is not listed on the WordPress.org directory. It updates itself directly from this GitHub repository using the bundled Plugin Update Checker library (in plugin-update-checker/). Once a site is running a version with the updater (1.0.4 or later), new versions appear on the normal Dashboard → Updates screen and install with one click — no more manual zip uploads.

The very first install of 1.0.4 must still be uploaded manually, because the older versions already on your sites don't know how to self-update yet. After that, releases flow automatically.

Publishing a new version

1. Make your changes and bump the Version: header in wardtech-apps-connector.php.
2. Commit and push to main.
3. Create a GitHub Release whose tag matches the new version prefixed with v, e.g. v1.0.5. (Using the auto-generated source zip is fine — no need to attach a custom build.)

Sites check for updates a few times a day and will offer the release. To force a check on a site, visit Dashboard → Updates and click Check again, or run wp plugin update wardtech-apps-connector with WP-CLI.

The repository must remain public for sites to fetch updates without credentials. If it is ever made private, each site needs a GitHub access token configured in the update checker.

Uninstalling

Deactivating the plugin clears the scheduled daily report (wp_clear_scheduled_hook). Any wp-config.php changes you made above are independent of the plugin and can be left in place or removed as you see fit.