Description
DatPilot Connector works on its own, with no account and nothing sent outside your site, and can optionally be connected to DatPilot, a WordPress maintenance service for Vietnamese site owners. The admin screens are in Vietnamese.
Works without connecting (all features, free):
- Health score in Settings DatPilot: outdated core/plugins/themes, PHP version, debug output, HTTPS, risky settings, admin accounts, backup age. Read only.
- Manual backup of the database and wp-content, run in small steps so cheap hosting does not time out. Backups stay on your hosting (in a randomly named, access-denied folder under uploads); the database dump is encrypted when the sodium extension is available. Download or delete them from the same screen.
- Malware and spam scan (read only): compares WordPress core and plugins downloaded from WordPress.org against the official checksums, looks for common backdoor patterns in themes, premium plugins and the uploads folder, and finds posts injected with gambling/casino spam or hidden links.
- PHP fatal error log: records fatal errors (white screen, “critical error”) without enabling WP_DEBUG, in the same protected folder as the backups. Server paths, emails, phone numbers and quoted values are removed from the message, and only the page path (no query string) is kept.
When connected to DatPilot (you paste a connection key from your DatPilot account), the service can alert you by Telegram when the site is down or throws fatal errors, send a monthly report, run scheduled backups and weekly scans.
The connection is limited to monitoring and data. DatPilot can only send a fixed list of signed, read-mostly commands: site information, health check, the read-only scans above, reading the PHP error log, purging the page cache, and creating, listing or deleting backups. This plugin gives DatPilot no administrative actions: it cannot install, activate, deactivate or update plugins, themes or WordPress core, restore backups, change settings, manage users or run code. Disconnect or deactivate the plugin at any time to stop all access.
Tiếng Việt: Plugin kiểm tra sức khoẻ web, sao lưu thủ công, quét mã độc và spam SEO, ghi lỗi PHP nghiêm trọng, dùng miễn phí không cần tài khoản. Kết nối DatPilot (tuỳ chọn) để được báo qua Telegram khi web sập, nhận báo cáo tháng và dùng gói bảo trì.
External services
This plugin can talk to the following services. Nothing is sent before you act as described.
DatPilot (datpilot.com) — only after you paste a connection key in Settings DatPilot.
- On connect, the plugin sends your site ID, home URL, REST URL, WordPress, PHP and plugin versions to
https://app.datpilot.com/api/v1/connector/hello. - Afterwards DatPilot sends signed commands (Ed25519, single-use nonce, 5-minute window) to your site’s REST endpoint
/wp-json/datpilot/v1/runand receives the results: version lists, health check flags, scan findings (suspicious file paths, IDs and titles of posts that look like spam), PHP fatal errors (type, file, line, page path without query string, message with personal data removed), backup status. Backups themselves stay on your hosting and are never sent to DatPilot. Automated reports contain no customer, order or member data. - Terms of use: https://datpilot.com/dieu-khoan
- Privacy policy: https://datpilot.com/chinh-sach-bao-mat#connector
WordPress.org — only when you (or DatPilot, if connected) run a deep scan.
- Official core checksums from
https://api.wordpress.org/core/checksums/1.0/(through WordPress’get_core_checksums()). - Plugin checksums from
https://downloads.wordpress.org/plugin-checksums/<slug>/<version>.json. Only the plugin slug and version are sent. - WordPress.org privacy policy: https://wordpress.org/about/privacy/
Installation
- Install from Plugins Add New, or upload the zip, then activate.
- Open Settings DatPilot to see the health score, make a backup or run a scan.
- Optional: to connect, create a free account at datpilot.com, add your site under “Web của tôi” and paste the connection key.
FAQ
-
Does the plugin send anything without connecting?
-
No. Without a connection key the only outside requests are the WordPress.org checksum lookups when you click a scan button.
-
Does the scan delete or change files?
-
No. The scan only reads files and the database and lists what looks suspicious.
-
Where are backups stored?
-
In a randomly named folder inside wp-content/uploads with access denied by .htaccess/web.config. At most 5 backups are kept. Download one to your computer for safekeeping.
-
What happens when I delete the plugin?
-
The connection key, settings and the backup folder (with the error log) are removed.
-
Can DatPilot change my site through this plugin?
-
No. The plugin only answers read commands and creates, downloads or deletes its own backups. It has no command to install, update, activate or deactivate anything, restore a backup or change settings.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“DatPilot Connector” is open source software. The following people have contributed to this plugin.
Contributors
Translate “DatPilot Connector” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.6.0
- Remote administrative commands removed: DatPilot can no longer update, install, activate or deactivate plugins, themes or core, restore backups or change hardening settings through this plugin.
- No more file in wp-content/mu-plugins; fatal errors are caught by the plugin itself.
- All names now use the
datpcoprefix (existing settings and connection are migrated automatically). - Admin JavaScript moved to an enqueued file; database dump uses $wpdb->prepare() with identifier placeholders (requires WordPress 6.2).
1.5.0
- The mu-plugin error catcher is now opt-in (button on the settings page, or enabled by DatPilot after you connect).
- Escaping and nonce checks cleaned up for the WordPress.org review; readme with external service disclosure.
1.4.2
- PHP fatal error log, page sampling for update screenshots.
1.3.1
- Malware, backdoor and SEO-spam scan.
1.2.0
- Backups and restores run in small steps; Ed25519 signed commands.