Description

Storita Connector exposes safe, read‑only access to your WordPress database over the REST API.

Key features:
– Read‑only queries (SELECT only) with robust validation
– API key authentication (or admin users via WP login)
– Nginx/FastCGI friendly header handling (X-Storita-Key, legacy X-DF-Key, or Authorization)
– Built-in rate limiting (1200 requests per hour per API key by default) and a maximum of 1000 rows per query by default
– Optional table whitelisting (restrict access to specific tables/patterns)
– Excluded tables list (empty by default); passwords, login keys and other secrets are always protected
– Secret redaction: password hashes, WordPress auth keys and salts and the API key are removed from every query result
– Schema explorer and health status endpoints; reading error logs is opt-in and off by default
– Admin settings page with copy‑to‑clipboard helpers
– Google Analytics 4 Integration: Proxy requests to GA4 using the existing Google Site Kit connection (supports standard and real-time reports).

This plugin is designed for integrations and reporting tools that need controlled, secure, read-only database access.

Requires a Storita.ai account. The plugin connects your store to the Storita.ai service (https://storita.ai); without a Storita.ai account the data it exposes has no consumer and the plugin has no purpose.

External services

Storita.ai

This plugin connects your WordPress/WooCommerce store to Storita.ai (https://storita.ai), a store analytics and assistant service. Storita.ai uses the plugin to read your store data so it can answer questions and produce reports about your store.

When data is made available:
– Only after the site owner configures an API key in Settings -> Storita.
– Only in response to requests sent to your site’s REST endpoints under the storita/v1 namespace (the legacy df-db/v1 namespace is still answered), either by the Storita.ai service using the API key in the X-Storita-Key (or legacy X-DF-Key) or Authorization header, or by a logged-in administrator.
– Nothing is sent on activation. The plugin makes no calls to storita.ai itself and does not track visitors.

What data is made available:
– Store profile, products, orders and customers data.
– The database schema (schema explorer) and read-only SQL SELECT query results (POST /query). Queries are SELECT-only and validated; tables the site owner excludes are blocked; credential tables are always blocked; and password hashes, WordPress auth keys and salts and the API key are removed from every result.
– Google Analytics 4 data, proxied through your site’s existing Google Site Kit connection (see below).
– Runtime health information. Log data (/health/logs, /health/logs/tail: debug.log, WooCommerce logs, the PHP error log) is shared only if the site owner turns on “Allow Storita to read error logs” in Settings -> Storita (off by default). Logs may contain personal data.
– The public /status endpoint returns only ok and the time.

The admin Test Connection feature calls only the site’s own REST URL (its own address) and never leaves the site.

Storita.ai legal documents:
– Privacy Notice: https://storita.ai/legal/privacy-notice
– Terms (Data Processing Addendum): https://storita.ai/legal/data-processing-addendum
– Trust Center: https://storita.ai/legal/trust-center

Google Analytics Data API (via Google Site Kit)

Only if Google Site Kit is installed and connected to Google Analytics 4: when the Storita.ai service or an administrator calls /google-analytics/report or /google-analytics/realtime, the plugin forwards the requested report fields (metrics, dimensions, date ranges, filters, ordering and limits) to the Google Analytics Data API (analyticsdata.googleapis.com) using Site Kit’s existing Google connection and the Google Analytics property configured in Site Kit. Google returns aggregated analytics report data. Nothing is sent to Google unless such a request is made, and the plugin sends no visitor data of its own.

Google Terms of Service: https://policies.google.com/terms
Google Privacy Policy: https://policies.google.com/privacy
Google Analytics Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/

Usage

Base URL: https://your-site.example/wp-json/storita/v1

The legacy base URL https://your-site.example/wp-json/df-db/v1 is still supported.

Authenticate by sending one of the following headers:
– X-Storita-Key: YOUR_API_KEY
– X-DF-Key: YOUR_API_KEY (legacy)
– Authorization: Bearer YOUR_API_KEY
– Authorization: DF-Key YOUR_API_KEY

If you are logged in as an administrator (manage_options), endpoints are accessible without the API key.

Endpoints

1) POST /query
– Body params:
– query (string) – SQL SELECT query to execute
– query_base64 (string, optional) – Base64-encoded SQL (alternative to query)

Example (JSON body):
curl -X POST "https://your-site.example/wp-json/storita/v1/query" \ -H "X-Storita-Key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "SELECT ID, post_title FROM wp_posts WHERE post_status=\"publish\" LIMIT 5"}'

2) GET /schema
– Query param: table (optional) – returns structure for a specific table; omit to list all tables

Examples:
curl -H "X-Storita-Key: YOUR_API_KEY" "https://your-site.example/wp-json/storita/v1/schema" curl -H "X-Storita-Key: YOUR_API_KEY" "https://your-site.example/wp-json/storita/v1/schema?table=wp_posts"

3) GET /status
– Public health endpoint; no auth required

curl “https://your-site.example/wp-json/storita/v1/status”
`

4) POST /google-analytics/report
– Queries Google Analytics 4 using Site Kit authentication.
– Body params: GA4 RunReportRequest JSON (metrics, dimensions, dateRanges, etc.)

Example:
curl -X POST "https://your-site.example/wp-json/storita/v1/google-analytics/report" \ -H "X-Storita-Key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"dateRanges": [{"startDate": "30daysAgo", "endDate": "today"}], "metrics": [{"name": "activeUsers"}]}'

5) GET /health/logs and /health/logs/tail
– Off by default; enable “Allow Storita to read error logs” in Settings Storita.

Security Controls

Requests per window – Rate limit per API key or IP (default 1200 requests per 3600 seconds).
Rate limit window (seconds) – How long the window lasts.
Maximum rows per query – Adds LIMIT automatically when missing; blocks excessive LIMITs (default 1000; 0 disables).
Excluded tables – Select specific tables to block. Nothing is blocked by default; passwords, login keys, API key secrets and 2FA secrets are always protected.
Allowed tables (optional) – Whitelist tables/patterns (e.g., wp_posts, wp_%). Leave empty to allow all tables unless excluded.
Allow Storita to read error logs – off by default.

Filters

storita_wp_rest_api_query – Filter the final SQL before execution.
- Params: string $query, WP_REST_Request $request
storita_wp_rest_api_validate_key – Custom validation strategy for API keys.
- Params: ?bool $is_valid, string $provided_key, ?WP_REST_Request $request

Installation

Upload the plugin folder to /wp-content/plugins/ or install via the Plugins screen.
Activate the plugin through the ‘Plugins’ screen in WordPress.
Go to Settings → Storita.
Configure an API key and (optionally) security controls like rate limits and table whitelist.

FAQ

1) Does this plugin allow INSERT/UPDATE/DELETE?
– No. Only SELECT queries are permitted. Dangerous commands are blocked.

2) My server drops Authorization headers. What can I do?
– Send X-Storita-Key: YOUR_API_KEY (or the legacy X-DF-Key) or configure your server to pass Authorization headers. The plugin also inspects common server variables and getallheaders() when available.

3) How do I prevent huge responses?
– Use the admin setting “Maximum rows per query” (default 1000 rows). The plugin will append a LIMIT if missing and reject LIMIT values above the maximum.

4) Can I restrict which tables can be queried?
– Yes. You can exclude tables via “Excluded tables” and/or whitelist via “Allowed tables”. For the whitelist, provide exact names (e.g., wp_posts) or wildcard-like patterns (e.g., wp_%).

5) Does the plugin send data without my knowledge?
– No. The plugin never contacts storita.ai on its own. It only answers requests from the Storita.ai service or an administrator, and only after you configure an API key.

6) Who can call the endpoints?
– Only the API key holder or a logged-in administrator. The /status endpoint is public and returns only ok and the time.

7) Can the SQL endpoint modify my database?
– No. Queries are SELECT only, validated, subject to row limits, and excluded tables are blocked.

8) Can the Storita service read passwords or secret keys?
– The plugin is designed to keep them out of reach. Credential tables are always blocked, UNION and derived-table queries on the users, user meta and options tables are refused, and password hashes, WordPress auth keys and salts and the plugin’s API key are removed from every query result. These are layered safeguards on a read-only SQL interface, not a guarantee against every possible query, so treat the API key like a password: share it only with Storita, and regenerate it in Settings Storita if you disconnect.

Reviews

kedemdpc November 2, 2026

Clean and powerful! adds impressive AI capabilities to my store

Read all 1 review

Contributors & Developers

“Storita Connector” is open source software. The following people have contributed to this plugin.

Storita

Translate “Storita Connector” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

2.3.1

Security: WooCommerce Analytics reports are served without switching to or acting as any WordPress user; the API key grants read-only report access only.
Changed: the read-only database and old-copy notices appear only on the Plugins screen and the Storita settings screen.

2.3.0

Added: optional read-only database connection for /query and /schema (constants STORITA_WP_RO_DB_USER and STORITA_WP_RO_DB_PASSWORD) with a 20-second session statement cap; falls back to the main connection with an admin notice.
Added: named API keys managed with WP-CLI (wp storita key add|list|revoke); the existing key keeps working as “default”.
Changed: rate limiting is counted per API key name; HTTP 429 responses carry a Retry-After header.
Changed: /query responses include truncated: true when the row cap cut the result.

2.2.4

Security: query results are scanned and password hashes, WordPress auth keys and salts and the API key are removed; UNION and derived-table queries on the users, user meta and options tables are refused.
Changed: rate limiting (1200 requests per hour per API key) and a 1000-row cap are on by default; sites still at the old 0 default move to the new defaults on upgrade. Each query has a 15-second MySQL time cap.
Changed: reading error logs is opt-in (Settings Storita “Allow Storita to read error logs”) and off by default.
Changed: the REST namespace is now storita/v1 and the X-Storita-Key header is accepted; df-db/v1 and X-DF-Key keep working.
Changed: the Google Analytics proxy always uses the property configured in Site Kit and forwards only GA4 report fields.
Changed: plugin slug and text domain are now storita-connector (main file storita-connector.php). Requires WordPress 6.2 or later.
Fixed: escaping in the admin connection-test results; notices no longer hide other plugins’ notices or appear site-wide; Clear Cache no longer flushes the whole object cache; all database queries use prepared statements.
Removed: the unused limit and offset parameters of POST /query.

2.2.3

Changed: nothing is excluded by default; the excluded-tables list is now empty unless you choose tables.
Added: WooCommerce API key, webhook and Wordfence 2FA secret tables are always blocked.
Upgrade: an untouched 2.2.2 default list is cleared automatically; customised lists are kept.

2.2.2

Prepared for the WordPress.org plugin directory: updates are now delivered by WordPress.org.
Removed the built-in update checker and the Check for Updates button.
Plugin name is now Storita Connector.

2.2.1

Fix: Site Kit GA proxy (/google-analytics/report, /google-analytics/realtime) returned HTTP 500 “Site Kit integration class not found” due to a namespace mismatch; corrected caller references so the Google Analytics fallback path works.

2.2.0

New endpoint: /df-db/v1/health/runtime — PHP/WP/WC runtime profile + Site Health results
New endpoint: /df-db/v1/health/logs — list available log sources
New endpoint: /df-db/v1/health/logs/tail — bounded log tail (allowlist + hard caps)

2.1.41

Fix: expose plugin version under meta.plugin_version on the auth-gated /site-profile endpoint so Storita’s backend can read it without the public /status disclosure (F-L-01).

2.1.40

Fix: DEFAULT_EXCLUDED_TABLES now resolves against actual $wpdb->prefix at runtime; default exclusions work correctly on custom-prefix installs. MySQL system schemas (information_schema, mysql, performance_schema, sys) blocked by default.

2.1.39

Polish: remove debug logging, console statements, and dead comments; harden non-critical SQL calls; deduplicate auth helpers; add LICENSE file; correct readme branding; remove version disclosure from public status.

2.1.38

Security: redact SQL details from /query error responses; deny-by-default for analytics sub-endpoints; require manage_options for browser-based analytics access.

2.1.37

Security: filter sensitive rows/columns from /query results (wp_users password hashes, wp_options auth keys, wp_usermeta session tokens); reject queries that reference protected fields; block information_schema reconnaissance; move update secret to per-site option with wp-config override.

2.1.16

Added: Support for Google Analytics 4 Real-time reports via POST /google-analytics/realtime
Added: Documentation for Real-time reporting
Improved: Site Kit integration with Reflection-based service access for extended API support

2.1.15

Added: Google Site Kit status (active, connected, property ID) to store profile endpoint
Improved: Site Kit integration with status helper method

2.1.14

Added: Google Analytics 4 integration via Google Site Kit piggybacking
Added: POST /google-analytics/report endpoint for querying GA4 data
Improved: Authentication handling for Site Kit credentials

2.1.13

Added: Stock management settings to store profile endpoint
Improved: Store profile data accuracy

2.1.12

Added: Full schema retrieval endpoint
Added: Documentation for schema endpoints

2.1.11

Added: API connection testing functionality with modal results in admin
Added: Cache warning functionality to site profile tests
Improved: Payment gateway retrieval and filtering logic
Improved: API requests with follow redirects support

2.1.1

Added: Enhanced site profile with comprehensive store and WooCommerce metadata
Added: Order status discovery and classification in site profile
Added: New helper methods for data retrieval
Improved: Response format for improved compliance with SQL reference specifications

2.0.3

Added: GET /site-profile endpoint for comprehensive WooCommerce site analysis with 6-hour caching
Site profile provides: store config, product catalog stats, pricing analysis, order metrics, customer analytics, checkout settings, marketing integrations, and data health indicators
Added: Table filtering/search functionality in admin settings for excluded tables
Improved: Admin UI with enhanced notification styles and better visual hierarchy
Improved: WooCommerce consumer secret field now preserves existing value when left blank
Improved: Password field placeholder styling for better UX
Fixed: Rate limit defaults adjusted for better performance
Removed: ‘wp_options’ from default excluded tables list to allow more flexibility

1.6.0

Added: Initial site-profile endpoint implementation
Enhanced: Admin UI with new styles and API key management functionality
Improved: Settings page layout with clearer organization
Added: Visual style guide documentation

1.5.0

Security: Removed hardcoded WooCommerce API credentials
Added: WooCommerce REST API credentials configuration in admin settings
Added: Comprehensive documentation (10 guides, 4,800+ lines)
Added: 11 WooCommerce Analytics endpoints with full documentation
Added: API key validation and authentication for analytics endpoints
Improved: Error handling for missing WooCommerce credentials
Admin: New “WooCommerce Analytics Configuration” section with setup instructions
Docs: Installation, Quick Start, API Reference, Authentication, Security, Troubleshooting, Examples
Enhanced: WooCommerce Analytics documentation with all endpoints enabled by default

1.4.2

Added: Storita_WP_Analytics_Route class for WooCommerce Analytics REST API integration
Added: Initial support for proxying WooCommerce Analytics endpoints
Feature: First implementation of analytics route registration

1.4.1

Added: Excluded tables feature with sensible defaults
Added: Admin settings for managing excluded tables
Security: Default exclusions for sensitive tables (users, usermeta, options, Action Scheduler, logs, caches)
Admin: Checkbox-based interface for selecting excluded tables

1.3.1

Admin: Added “Excluded tables” with checkbox list populated from DB tables and sensible defaults
Admin: Clearer wording for “Allowed tables”; it is now explicitly optional and works alongside exclusions
Admin: Improved padding in the Connection Details card

1.3.0

Added: Optional table whitelisting (admin setting)
Added: execution_time_ms metadata in query responses
Added: GET /status health endpoint (public, no authentication required)
Added: Table whitelisting feature with pattern support (e.g., wp_posts, wp_%)
Improved: Header compatibility for API key authentication (X-DF-Key, Authorization, Bearer, DF-Key)
Improved: Error logging for better debugging
Admin: Copy-to-clipboard functionality for API key and base URL
Admin: API key generator with secure random generation
Internal: Refactored to modular structure under includes/ directory
Internal: Created separate class files (Storita_WP_Config, Storita_WP_REST_API, Storita_WP_Admin)