Masetti Static Site Publisher

Description

This is a public beta (0.10.0). Masetti Static Site Publisher lets you keep WordPress as the place where you write, and serve the public site as plain static files from a cloud provider. There is no PHP and no database in front of your visitors: the site is fast, cheap to run and has almost nothing to attack.

What it does

• Exports the site by reading your own pages the way a visitor does (from your server to itself), so what is published is exactly what you see. You choose which content goes in, and a report tells you what was left out and why (forms, passwords, external links, search).
• Creates the hosting for you with a guided setup: an Amazon Web Services stack (private S3 bucket behind CloudFront), a Cloudflare Worker with static assets, or a Netlify site. Nothing is created before you confirm a summary of what will be made.
• Shows what it costs before you create anything, and lets you read what AWS really charged for a site afterwards. The estimates come from price tables inside the plugin, which can be out of date: they are an estimate, not a bill.
• Publishes versions and lets you put an earlier one back. A check compares the live site with the version you think is online and tells you if anything differs.
• Connects your own domain on Cloudflare and Netlify: the plugin links the name for you. On AWS the site answers on the address AWS gives it; connecting a domain there is not part of the plugin yet.
• Removes what it made: deleting a site deletes only the resources the plugin created, never anything else in your account.
• Speaks your language: the interface is translated (Italian included) and follows the language of your WordPress.
• Lets AI agents look, not touch (optional, off by default): an administrator can allow tools such as Claude Code, Codex or Cursor to read the state of the sites over MCP. An agent can only ask for an export or a publication; an administrator approves it in WordPress.

Your cloud account, your data

You use your own account with each provider. The credentials are stored encrypted in your database, are never written to the log and are sent only to that provider. The plugin is free and complete; there is no paid feature locked inside it.

Good to know

• Dynamic features cannot run on a static site. Forms, comments, search and anything that needs PHP at the moment of the visit are not part of the published site (the export report lists what it found).
• Creating resources at a cloud provider can cost money on your account. The plugin shows an estimate, asks for your confirmation and never creates anything on its own.
• A page cache in front of WordPress can stop the export from reading your pages; the plugin tells you when it happens.

Source code

The administration interface is built from the human-readable sources in the js/ directory
(React with @wordpress/scripts, Tailwind CSS 4 and Radix UI primitives). To rebuild it:
npm install && npm run build. The build configuration (postcss.config.js, webpack.config.js)
is included.

Third-party libraries

The plugin ships these open source libraries, all licensed under terms compatible with the GPL
(the Apache License 2.0 is compatible with version 3 of the GPL, which the “or later” of the plugin
license allows):

PHP, in vendor/ and vendor-prefixed/:

• AWS SDK for PHP (aws/aws-sdk-php, the official SDK), Apache License 2.0: https://aws.amazon.com/sdk-for-php/
• Guzzle (guzzlehttp/guzzle, guzzlehttp/psr7, guzzlehttp/promises), PSR interfaces, jmespath.php and the Symfony polyfills and filesystem component, MIT license
• AWS Common Runtime for PHP (aws/aws-crt-php), Apache License 2.0
• Action Scheduler (woocommerce/action-scheduler), GPL-3.0-or-later

The AWS SDK and its dependencies are included unmodified, except that their namespaces are prefixed
with ASBuilder\Vendor (done with PHP-Scoper) so they cannot collide with other plugins.
third-party/composer.json and third-party/composer.lock list the exact versions.

JavaScript, in the compiled administration interface:

• Radix UI primitives (radix-ui and its dependencies), MIT license: https://www.radix-ui.com/
• Tailwind CSS (build-time, generates the stylesheet), MIT license: https://tailwindcss.com/
• shadcn/ui component patterns, adapted in js/ui/, MIT license: https://ui.shadcn.com/
• clsx and tailwind-merge, MIT license
• Lucide icons (lucide-react), ISC license: https://lucide.dev/
• tslib, 0BSD license

Typeface, in fonts/ (loaded from your own site, never from another):

• Public Sans, SIL Open Font License 1.1 (fonts/OFL.txt): https://github.com/uswds/public-sans

External services

The plugin talks to a cloud provider only after you have chosen it and entered your credentials for it, and only to set up, check, publish to or remove your own site. It sends no data to the author of the plugin and has no tracking, advertising or usage statistics.

Amazon Web Services (AWS) — to create, update, check and delete the hosting of a site (CloudFormation, S3, CloudFront, Certificate Manager, IAM and STS) and to upload the files of the site to your S3 bucket. It sends your access credentials (or the role you configured), the names and settings of the resources, and the files of your exported site. It is used when you create, change, publish, check or delete a site, and when you test the connection. Terms: https://aws.amazon.com/service-terms/ — Privacy: https://aws.amazon.com/privacy/

AWS Cost Explorer — only when you press “Read the real cost” for a site. It sends the label of that one site (asbuilder:site) and the period, and returns what AWS charged for it. AWS charges about 0.01 USD for each reading, so the plugin never does it by itself. Same terms and privacy policy as AWS.

Cloudflare — to create, check, publish to and delete the Worker that serves a site, and to link your own domain to it (api.cloudflare.com). It sends your API token and account ID, the name and settings of the Worker and the files of your exported site. It is used when you create, change, publish, check or delete a site, and when you test the connection. Terms: https://www.cloudflare.com/terms/ — Privacy: https://www.cloudflare.com/privacypolicy/

Netlify — to create, check, publish to and delete a Netlify site, and to link your own domain to it (api.netlify.com). It sends your access token, the name and settings of the site and the files of your exported site. It is used when you create, change, publish, check or delete a site, and when you test the connection. Terms: https://www.netlify.com/legal/terms-of-use/ — Privacy: https://www.netlify.com/privacy/

The plugin does not download code from anywhere: everything it runs is in the plugin. Its own pages (dashboard, setup wizard) load nothing from other sites; the typeface is served from your site. The credits box in the dashboard has links to the author’s websites, which are opened only if you click them.

Privacy

The plugin stores, in your own database, the sites you set up, the credentials you enter (encrypted), the exports and publications, and a log with credentials and secrets removed. It sets no cookies on the visitors of your site. When you delete the plugin, this data is removed (to keep it, set the option asbuilder_keep_data_on_uninstall before deleting the plugin). Data held by the cloud providers is governed by their own policies, linked above. If you publish a site to a provider, the published files are public to whoever visits that site, as with any website.