Description

SteerWP Connector is the free client-site plugin in the SteerWP suite. Install it on each WordPress site an agency manages and pair it with the agency’s SteerWP Console. It does two things:

For the agency (on the Console): once paired, the Console can read this site’s status – WordPress, plugin and theme inventory and available updates, uptime and health data, pending comments, security and performance snapshots – receive form submissions (Contact Form 7, Gravity Forms, WPForms), moderate comments, create draft content, switch maintenance mode, and create backups for download. Every request is authenticated by the pairing secret in both directions. This plugin performs no administrative actions: it does not install, update or remove plugins or themes, update WordPress core, manage users, restore backups, or allow remote login. Agencies that want those management operations can use SteerWP Connector Pro, distributed separately from steerwp.com.

For the client (on this site): a small “Your agency” area in WordPress admin, branded with the agency’s name and colour, showing the connection status and any documents the agency has shared for this site — reports, proposals, audits, training material or other files — in one Documents screen. Nothing is shown unless the agency shares it. This area is hidden by default; the agency turns it on from its Console (Settings Branding Client-site area). When shown, only users with the view_agency_dashboard capability see it (administrators by default).

Capabilities exposed

The plugin responds to the following capability calls from the paired Console:

system_info, plugins_inventory, themes_inventory, core_status
security_snapshot, performance_metrics
forms_discover, forms_capture (event-driven: pushes CF7, Gravity Forms and WPForms submissions to the Console)
page_html, apply_branding, help_panel, run_optimization, actions
backup-creation and maintenance-mode capabilities used by the agency’s add-ons

Privacy

SteerWP Connector only communicates with the one SteerWP Console site it has been paired with. No data is sent to the plugin author or any other third party. Disconnecting (Settings SteerWP Connection) stops all communication immediately.

External Services

This plugin exists to connect a WordPress site to a SteerWP Console – the management dashboard operated by the site’s own agency on the agency’s own WordPress installation. It does not communicate with any service operated by the plugin author, and it sends nothing anywhere until the site owner (or their agency) completes pairing.

What the service is: the paired SteerWP Console – a WordPress site chosen at pairing time, identified by the URL entered on the connection screen. It is operated by the agency that manages this site, not by SteerWP.

What is sent, and when:

At pairing: the site URL and a one-time connection code, exchanged for the pairing secret.
On request from the Console (authenticated with the pairing secret): site status – WordPress/plugin/theme versions and updates, health, uptime, security and performance snapshots, pending comments, page HTML for previews, backup archives when the agency runs a backup.
Event-driven, as they happen: form submissions from supported form plugins (the submitted form data, so the agency can follow up on leads), and service-account changes made on the connection screen.
Every 12 hours (and when the connection screen is opened): a request for the agency’s branding and display settings.

Where it goes: only to the paired Console’s REST API ({console-url}/wp-json/steerwp/v1/...), over the site’s normal HTTP transport. Disconnecting on the connection screen, or deactivating the plugin, stops all of it immediately.

Policies: the SteerWP software is provided by SteerWP – terms of service and privacy policy. Because the Console receiving the data is operated by your own agency, their handling of that data is governed by your agreement with them; consult your agency’s privacy policy for how they store and use it.

Screenshots

Pairing screen where the agency credentials are pasted

Branded Overview dashboard with KPI cards — Pairing screen where the agency credentials are pasted

Installation

On the agency’s site, install the free SteerWP Console plugin.
On the client’s site, install and activate SteerWP Connector (Plugins Add New search “SteerWP Connector”, or upload the zip).
On the client’s site, open Settings SteerWP Connection. A one-time connection code is shown.
In the Console, add the site under its client by entering the site URL and that connection code.
The site pairs immediately; the “Your agency” area appears on the client site and the Console starts reading the site’s status.

FAQ

Does this plugin do anything on its own?: No. It waits to be paired with a SteerWP Console. Until then it shows only the connection screen under Settings.
Is this free?: Yes. Both SteerWP and SteerWP Connector are free, open-source GPL plugins. Paid extensions are sold separately and are installed only on the master site.
Who can see the branded dashboard?: Any user on this site with the view_agency_dashboard capability. By default that is administrators only. You can grant it to specific staff users with any role-management plugin.
What if I want to stop the connection?: Go to Settings SteerWP Connection and click Disconnect. The plugin stops responding to Console requests and removes the “Your agency” menu. Deactivating or deleting the plugin has the same effect.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“SteerWP Connector” is open source software. The following people have contributed to this plugin.

Deepak Hasija

Translate “SteerWP Connector” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.28.2

First public release.
Pairs a site with a SteerWP dashboard using a one-time code that expires in ten minutes.
Reporting and monitoring: available updates, plugin, theme and core versions, site health.
Backups: create and download.
Form submission forwarding.
Comment moderation and draft content.
Maintenance mode and cache clearing.
No remote administrative actions. The paired dashboard cannot install, update, activate or
delete plugins or themes, update core, manage users, restore files, or log in as a user.
The site owner can disconnect at any time from the connection screen, which invalidates
the connection immediately.

1.28.1

Removed core file includes left over from the removed install and update actions.

1.28.0

This WordPress.org build no longer performs administrative actions: installing, updating, activating or removing plugins and themes, WordPress core updates, user management, backup restore, remote settings changes and remote login have all been removed, along with the service-account feature.
Everything else continues to work: status, health, uptime and security reporting, form-submission forwarding, comment moderation, draft content creation, maintenance mode, and backup creation and download.
The connection screen’s disclosure card now reflects this reduced scope.

1.27.1

Plugin and theme installation requests now accept WordPress.org slugs only; installing from arbitrary URLs is no longer permitted.
Restore uploads only accept plain backup-archive filenames (.zip / .sql).
One-click agency login tokens can no longer be replayed after their five-minute guard if the token itself lives longer.
The maintenance page’s styles and the connection screen’s script now load through the WordPress style/script APIs.
Removed unused WordPress core file includes.
The External Services section now documents exactly what is sent to the paired Console and when, including form submissions.

1.27.0

First WordPress.org release. Consolidated notes since 1.23.3:

New: The “Your agency” area is hidden by default and only appears when the agency enables it from its Console (Documents-only or full). Branding — agency name, colour, logo, menu label — now syncs from the Console every 12 hours and whenever the connection screen is opened.
New: Documents from your agency are shown on a single screen with type filters (reports, proposals, audits, training, other) instead of five separate menus.
New: The connection screen explains in plain language what the paired agency can and cannot do through this plugin, and how to disconnect.
New: Connection codes replace pasted tokens — pairing takes one code and one click. Existing sites can be paired from the Console.
New: The service account used for one-click agency login is set automatically and can be changed on the connection screen.
Improved: Backups are stored under the uploads directory and all file operations go through the WordPress filesystem API; database restores replay only statement types a dump contains.
Improved: Every option and transient uses the steerwp_ prefix; inputs sanitised and outputs escaped throughout; translation loading happens at the correct time on WordPress 6.7+.
Improved: The agency menu, when shown, sits below the core WordPress items.
Removed: The remote WP-CLI runner (not permitted for WordPress.org-hosted plugins).

1.23.3

system_info now reports client_version. Every consumer has been reading this key from the system_info response — the Console’s sync uses it to refresh sites.child_version, and Maintenance Pro’s compatibility probe used it to verify support — but the key never existed there. The only capability that ever returned it was restore_preflight. As a result the Console’s version column could never refresh, and Maintenance Pro disabled its controls with “unknown version” against perfectly compatible sites, through four consecutive releases of fixes aimed downstream of the real defect.

1.23.2

Fixed: the three maintenance capabilities were unreachable. Capability dispatch works by convention — call( $slug ) invokes handle_<slug> — and a working capability needs BOTH an entry in the SUPPORTED allowlist (checked first; missing means 404) AND a handle_* method (checked second; missing means 501). The maintenance logic had neither: it was added as cases inside handle_actions(), reachable only indirectly through the actions capability. Every direct call from the Console returned 404, which surfaced as a generic error, and Maintenance Pro greyed out its own controls with no indication why.
Fixed: create_content and media_upload had the same defect, and have had it for far longer. Both are allowlisted, both are called directly by the Console, and neither had a handle_* method — only an action_* method reachable through actions. Content Composer publishing and media upload to client sites were failing at the REST layer with a 501. Found by a capability-contract check written while chasing the maintenance 404.

1.23.1

The maintenance page’s background style is now derived from the chosen template rather than a separate bg_style field. The two could disagree, and the template always lost — so a site set to the Gradient, Photograph, Split or Geometric template rendered on a flat colour instead.
The Split template falls back to an accent gradient when no background image is set, instead of rendering a blank white panel.
Template revision bumped to 2. The Master compares this against its own preview renderer and warns if they have drifted.

1.23.0

Maintenance mode rewritten. It previously wrote WordPress’s .maintenance file, which has two defects that together made the feature misleading: WordPress checks for that file BEFORE authentication, so it locked the agency out of the site along with everyone else; and WordPress stops honouring it after ten minutes, so the site silently came back online while the Console still reported it as down.
Maintenance is now served from template_redirect. Anyone who can edit posts — the agency and the client’s editors — passes straight through to the real site. It stays on until it is turned off. It serves HTTP 503 with a Retry-After header, so the maintenance page is never indexed in place of the real content.
Six page templates ship with the plugin, along with four generated backgrounds. All backgrounds are original generated art, GPL, served from the site’s own domain — nothing is fetched from a third party while the site is down.
New capabilities: maintenance_design and maintenance_status. system_info now reports the real maintenance state instead of testing for a file that WordPress may already have begun ignoring.
Any stale .maintenance file left behind by the old implementation is cleaned up on the next toggle.
wp-admin now shows a notice while the site is in maintenance, including how long it has been down.

1.0.0

Initial release