ctrlweb Site Portrait

Description

Choosing the right hosting means knowing your site: WordPress and PHP versions, plugins and themes, database size, number of posts and media files, server memory and CPU, caches in place… ctrlweb Site Portrait lets a service that you choose (typically a hosting provider or an agency) read that information securely, without giving it an administrator account.

• Off by default. Nothing happens and nothing is sent until you enter the address of a service and approve the connection.
• Any compatible service. The plugin is not tied to any company, including its author. It implements Site Portrait, an open protocol documented in docs/PROTOCOL.md (included in the plugin), so anyone can build a compatible service.
• You choose what is shared. Seven categories (WordPress core, plugins, themes, server, database, content volumes, user counts) can be ticked or unticked at any time.
• Read-only and minimised. The service can never change your site. The plugin never shares passwords, keys, wp-config.php values, user names or email addresses, post content, file paths, the database prefix or server IP addresses.
• No password to leak. Instead of a password, the site and the service exchange public keys. Every request is signed (HTTP Message Signatures, RFC 9421, with Ed25519) and can only be used once. Even a copy of your database does not let anyone impersonate the service.
• Transparent. An access log shows every request (date, IP address, categories). Optional IP allow-list, rate limiting, one-click disconnection and key rotation.
• Multisite ready. On a network, a super admin connects the whole network from the Network Admin.

How it works

1. In Settings → Site Portrait, enter the address given by the service (for example https://service.example).
2. The plugin reads the service description (/.well-known/site-portrait) and shows you its name, privacy policy and the data it asks for. Tick the categories you agree to share.
3. Click Connect: you are sent to the service to sign in and approve, then back to your dashboard.
4. The service can now request the portrait. You can change the categories or disconnect at any time.

For developers

The full protocol (discovery, pairing, request signatures, endpoints, errors, JSON schemas and test vectors) is in docs/PROTOCOL.md and docs/schema/. The filter site_portrait_scope_data lets other plugins add data to a category.

Licenses

The plugin code is licensed under the GPL, version 2 or later (GPL-2.0-or-later). The protocol specification and JSON schemas in docs/ are licensed under Creative Commons Attribution 4.0 (CC-BY-4.0), so that anyone can implement a compatible service.

External services

This plugin connects your site to one external service chosen and entered by the site administrator. No service is built in, and the plugin never contacts any server until an administrator enters a service address and asks to look it up.

What is sent, to whom and when:

• When the administrator clicks “Look up service”: the site requests https://<service>/.well-known/site-portrait to display the service name, privacy policy and requested data. Only a standard HTTP request is sent (it includes your site address in the User-Agent).
• When the administrator clicks “Connect” and approves on the service: the administrator’s browser is sent to the service’s authorization page with your site address, site name, the categories ticked and a public key. The site then sends the service, server to server, the authorization code, its public key, the addresses of its Site Portrait API endpoints, the plugin version and the categories granted.
• While connected: the service may request the portrait. The site only answers signed requests and only returns the categories you ticked (see the Description for what each contains). On a multisite network, the list of site addresses is also available to the service.
• When the administrator clicks “Disconnect” or deletes the plugin: the site notifies the service that the connection ended (site address and connection identifier).

The service’s own terms of use and privacy policy apply to the data it receives. Their addresses are shown before you connect and on the settings page.