Description
Absoluit User Hub is a powerful, secure, centralized user management system designed specifically for WordPress. It enables network administrators to manage user accounts (create, update, search, and delete) across multiple connected child sites from a single, centralized WordPress master dashboard.
The system is distributed as a single unified plugin package that supports three active roles:
1. Master Dashboard Mode: Run on your central administration site. Exposes the main “User Hub” dashboard menus, connection diagnostics, AJAX controllers, and custom database mapping.
2. Client Agent Mode: Run on individual child nodes. Exposes custom REST API endpoints under a private namespace (wp-user-hub/v1) protected by a strict multi-layer verification middleware.
3. Both Mode: Runs both components simultaneously on a single WordPress installation (primarily used for local development and debugging).
Upon first activation, the plugin resides in a safe, uninitialized state and prompts the administrator to select the site’s role before loading any features.
Architecture Overview
- Central Dashboard (Master): The administrator interacts with the dashboard UI to trigger user operations. The Master component dispatches secure, signed REST requests to connected child sites using WordPress HTTP APIs.
- Child Nodes (Client): Expose custom REST API endpoints. An authentication middleware verifies credentials, allowed IP addresses, timestamp drift boundaries, and duplicate nonces before modifying the local WordPress user database.
Security
Absoluit User Hub implements several security controls to protect your user database:
* API Key Authentication: A high-entropy shared secret generated for each child site.
* IP Allowlisting: Strict enforcement restricting REST API requests to whitelisted Master IPs.
* Timestamp Drift Validation: Rejects requests where the server time difference exceeds 300 seconds to prevent outdated requests.
* Nonce Validation: Caches request nonces via transients to block replay attacks.
* HMAC-SHA256 Request Signing: Incoming request parameters are cryptographically signed using the shared secret API Key, ensuring payload integrity.
* Primary Admin Protection: Hardcoded checks explicitly block the deletion of user ID 1 (Primary Administrator).
Best Practices:
* Always run WordPress over HTTPS.
* Restrict Allowed Master IPs on the Client settings.
* Keep WordPress and plugins updated.
* Protect and rotate API keys regularly.
Screenshots
Installation
- Upload the
absoluit-user-hubdirectory to the/wp-content/plugins/directory of your WordPress site. - Activate the plugin through the ‘Plugins’ menu in WordPress.
- A notice will appear at the top of the admin dashboard asking you to select the plugin role:
- If configuring the central hub: Select Master Dashboard Mode. This will initialize the dashboard tables and show the User Hub sidebar menu.
- If configuring a child node: Select Client Agent Mode. Go to Settings > User Hub Client to copy the generated API Key and the REST API URL, and whitelist your Master server’s IP address.
- To change modes: Go to Settings > User Hub Settings at any time to switch roles. Mode switching is non-destructive; all existing settings and database records are preserved.
FAQ
-
Do I need a WordPress Multisite network to use this?
-
No. Absoluit User Hub is built specifically for independent WordPress installations. It does not require Multisite, letting you manage users across entirely different domains and servers.
-
How do I configure a child site?
-
Activate the plugin on the child site, select Client Agent Mode, navigate to Settings > User Hub Client, and configure the Allowed Master IPs (your central server’s IP). Copy the API Key and REST API URL. Then log in to your central master site (configured in Master Dashboard Mode), go to User Hub > Connected Sites, click Add Site, and paste the child site’s URL and API Key.
-
What is the difference between Master and Client modes?
-
Master mode runs the administration controls, allowing you to view and manage users on other sites. Client mode is a passive agent that exposes endpoints allowing the Master Dashboard to read/write user profiles securely.
-
Can I switch modes later?
-
Yes. Go to Settings > User Hub Settings in your WordPress admin panel and choose a new active role. All database custom tables and client settings options are retained and preserved.
-
Where do I find the Client API Key?
-
In Client Mode, go to Settings > User Hub Client in your child site’s WordPress admin panel. The API key is displayed in a password field. Click the eye icon to toggle visibility and copy the key.
-
What are Allowed Master IPs?
-
Allowed Master IPs is a security setting on the Client agent. You specify the external IP address of your Master Dashboard server. Any request arriving from a different IP address will be immediately blocked.
-
How does authentication work?
-
Authentication uses shared secret API keys and HMAC-SHA256 signature verification. Outgoing requests are signed with a hash generated using the API key, request body, nonce, and timestamp. The client re-calculates this hash to verify the integrity and origin of the request.
-
Can I bulk import sites?
-
Yes. In Master mode, the Connected Sites panel includes a bulk import feature where you can paste lists of sites with names, URLs, and API keys separated by commas or pipes.
-
What happens when deleting a user who owns posts?
-
When deleting a user from the dashboard, you can choose to assign their existing posts to a fallback administrator on the child site, preventing orphaned content.
-
What WordPress and PHP versions are supported?
-
This plugin requires WordPress 5.6 or later, and PHP 7.4 or later.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Absoluit User Hub” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Absoluit User Hub” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.1
- Security: Enforced strict capability check (manage_options) on the Client settings page.
- Security: Sanitized user identifiers in REST API endpoints to block potential output injection.
- Fix: Adjusted client whitelisting so that leaving Allowed Master IPs blank disables IP checking instead of blocking connections.
- Fix: Prevented API Key from being overwritten to empty on Client settings saves by removing it from registration and using readonly display fields.
- Fix: Restructured Master sites database schema setup to be fully compliant with WordPress dbDelta formatting and self-healing initialization.
- Fix: Migrated dynamic inline stylesheets and JS styles to standard enqueued stylesheet files.
- Fix: Added robust support for HTTP_CF_CONNECTING_IP and HTTP_X_FORWARDED_FOR reverse proxy client IP detection.
1.1.0
- Feature: Support for bulk importing child sites using CSV/pipe-delimited values.
- Feature: Added real-time connection status check badge.
- Security: Enforced IP Whitelisting checks by default.
- Security: Implemented transient-based nonce tracking to block replay attacks.
- Security: Added strict role validation checks and string bounds checking.
- Integration: Consolidated Master and Client plugins into a single package with a secure role setup flow.
1.0.0
- Initial stable release.