Title: OutscoreAgent Publisher
Author: outscoreagent
Published: May 24, 2026
Last modified: May 24, 2026
---
Search plugins
# OutscoreAgent Publisher
By [outscoreagent](https://profiles.wordpress.org/outscoreagent/)
[Download](https://downloads.wordpress.org/plugin/outscoreagent.1.5.3.zip)
* [Details](https://wordpress.org/plugins/outscoreagent/#description)
* [Reviews](https://wordpress.org/plugins/outscoreagent/#reviews)
* [Installation](https://wordpress.org/plugins/outscoreagent/#installation)
* [Development](https://wordpress.org/plugins/outscoreagent/#developers)
[Support](https://wordpress.org/support/plugin/outscoreagent/)
## Description
OutscoreAgent is a platform that generates high-quality, SEO-optimised articles
using AI and publishes them directly to your WordPress site.
This plugin creates a secure REST API endpoint on your WordPress installation that
the OutscoreAgent platform uses to push finished articles. Once installed and configured,
articles created on the OutscoreAgent platform are automatically published to your
site with their correct title, content, featured image, and metadata.
**Key features:**
* Secure bearer token authentication — only OutscoreAgent can publish to your site
* HTTPS enforcement — tokens are never transmitted over plain HTTP
* Per-site configuration — each WordPress site has its own independent token
* Structured error logging — detailed logs available in the admin panel
* Clean uninstall — removing the plugin deletes all its data from your database
**How it works:**
1. Install and activate the plugin
2. Generate an API token from the OutscoreAgent settings page
3. Enter the token and your site’s REST API URL in the OutscoreAgent platform
4. Articles are published automatically when they finish generating
**Third-party service requirement:**
This plugin is the WordPress-side companion of the [OutscoreAgent](https://outscoreagent.com/)
platform and requires an active OutscoreAgent account to be useful. The plugin itself
does nothing on its own — it exposes a secure REST endpoint that the OutscoreAgent
platform calls to publish generated articles, and it sends post-status updates back
to the platform so article state stays in sync. Without an OutscoreAgent account,
no data is ever sent anywhere; the plugin simply remains idle.
**Data transmitted to OutscoreAgent:**
When you configure a callback URL in the plugin settings (provided to you by the
OutscoreAgent platform), the plugin will transmit the following information to OutscoreAgent
each time a post it originally published changes status (draft publish, publish
trash, etc.):
* The post’s WordPress ID
* The post’s public permalink and WP admin edit link
* The new post status (e.g. `publish`, `draft`, `trash`)
* The OutscoreAgent external article ID the post is linked to
* A UTC timestamp
No post content, user personal data, or WordPress credentials are ever sent. See
the **External services** section below for the full disclosure. By using this plugin
you agree to the OutscoreAgent [Terms of Service](https://outscoreagent.com/terms)
and [Privacy Policy](https://outscoreagent.com/privacy).
### External services
This plugin relies on the OutscoreAgent platform at **https://outscoreagent.com/**
to function. An OutscoreAgent account is required — without one, the plugin stays
idle and no data leaves your site.
**Service used:** OutscoreAgent (operated by OutscoreAgent, the plugin author).
**What the service does:** Generates SEO-optimised articles with AI on OutscoreAgent’s
servers, then publishes them to your WordPress site via the REST endpoint this plugin
exposes. Tracks the post-status lifecycle (draft / published / trashed) for its
own content dashboard.
**When data is sent to the service:** Whenever a WordPress post that was originally
published by OutscoreAgent changes status (e.g. the editor moves it from draft to
publish, or trashes it). Sending is triggered by WordPress’s `transition_post_status`
hook. No data is sent for posts the plugin did not create. No data is sent before
you configure the callback URL in **Settings OutscoreAgent Publisher**.
**What data is sent:** A single JSON payload containing:
* `event` — the literal string `post_status_changed`
* `external_id` — the OutscoreAgent article ID this post is linked to
* `wp_post_id` — the numeric WordPress post ID
* `wp_post_url` — the public permalink of the post
* `wp_post_status` — the new WordPress post status (e.g. `publish`, `draft`, `trash`)
* `wp_edit_url` — the WordPress admin edit URL for the post
* `timestamp` — ISO-8601 UTC timestamp of the transition
No post content, user personal data, comments, WordPress credentials, or IP addresses
are transmitted.
**Transport:** HTTPS POST to the callback URL the OutscoreAgent platform configures
in the plugin settings. The plugin refuses to send callbacks over plain HTTP (localhost
is exempt for development only).
**Terms and Privacy:** The OutscoreAgent service is governed by its [Terms of Service](https://outscoreagent.com/terms)
and [Privacy Policy](https://outscoreagent.com/privacy). By connecting this plugin
to your OutscoreAgent account you agree to both.
## Screenshots
* [[
* [[
* [[
## Installation
1. Download the plugin ZIP from the OutscoreAgent platform or repository.
2. In your WordPress admin panel, go to **Plugins Add New Upload Plugin**.
3. Upload the ZIP file and click **Install Now**.
4. Click **Activate Plugin**.
5. Go to **Settings OutscoreAgent Publisher** to generate your API token.
6. Copy the token and paste it into the OutscoreAgent platform settings for this site.
**Manual installation:**
1. Unzip the plugin archive.
2. Upload the `outscoreagent` folder to your `/wp-content/plugins/` directory.
3. Activate the plugin from the WordPress admin **Plugins** screen.
## FAQ
### Do I need an OutscoreAgent account?
Yes. This plugin is the WordPress-side component of the OutscoreAgent platform.
You need an active OutscoreAgent account and at least one connected site to use
this plugin.
### Is HTTPS required?
Yes. All API requests from the OutscoreAgent platform must be made over HTTPS to
protect your bearer token in transit. The plugin will reject requests made over
plain HTTP in production environments.
### What data does the plugin store?
The plugin stores:
* Your API token (as a SHA-256 hash — the raw token is shown once and never stored)
* Plugin settings (debug mode, platform site ID)
* A publish log for auditing article sync activity
* Per-post metadata for synced articles
### What data does the plugin send to OutscoreAgent?
Only post-status change notifications, and only for posts that OutscoreAgent itself
originally published. See the **External services** section for the exact payload
and triggers. No user personal data or post content is transmitted.
### Where can I find error logs?
Error logs are stored in two places:
1. The WordPress `wp-content/debug.log` file (requires `WP_DEBUG_LOG` to be enabled
in `wp-config.php`)
2. The OutscoreAgent settings page in the WordPress admin panel, which shows the last
20 error entries
### How do I revoke the API token?
Go to **Settings OutscoreAgent Publisher** and click **Revoke Token**. This immediately
invalidates the current token. Generate a new token and update your OutscoreAgent
platform settings to resume publishing.
### Does this work with WordPress Multisite?
Yes. Each site in a multisite network has its own independent token and settings.
There are no network-level settings.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“OutscoreAgent Publisher” is open source software. The following people have contributed
to this plugin.
Contributors
* [ outscoreagent ](https://profiles.wordpress.org/outscoreagent/)
[Translate “OutscoreAgent Publisher” into your language.](https://translate.wordpress.org/projects/wp-plugins/outscoreagent)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/outscoreagent/), check
out the [SVN repository](https://plugins.svn.wordpress.org/outscoreagent/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/outscoreagent/)
by [RSS](https://plugins.trac.wordpress.org/log/outscoreagent/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.5.3
* Hardened: the `the_content` filter callback that prepends the featured-image
credit now passes its returned HTML through `wp_kses_post()` before concatenation.
The credit block was already built from escaped fragments (`esc_html` / `esc_url`/`
esc_attr` around the photographer name, URL, and source label), but the wordpress.
org review process requires the escape to be visible at the filter callback’s
return site, not only inside the helpers that assemble the string.
#### 1.5.2
* Fixed: plugin text domain renamed from `outscoreagent-publisher` to `outscoreagent`
to match the WordPress.org plugin slug. All translation strings, the language
template (`languages/outscoreagent.pot`), and the distribution zip’s top-level
folder are updated. Internal storage keys (`outscoreagent_settings`, `outscoreagent_publish_log`)
are unchanged, so existing installs preserve their token and configuration.
* Hardened: `register_setting()` sanitize callback now runs `sanitize_text_field()`
on the programmatically-written `site_id` and `token_hash` values before persisting
them.
* Hardened: the public `GET /status` REST endpoint now returns only `{ success,
plugin_version }` to unauthenticated callers. WordPress/PHP versions, site name,
post types, categories, and token state are returned only when the request carries
a valid API token. The endpoint remains public so the OutscoreAgent platform
can detect the plugin before a token is configured.
#### 1.5.1
* Fixed: removed the `Plugin URI:` header from the main plugin file. It pointed
to the same URL as `Author URI:`, which the WordPress.org reviewer flagged. `
Author URI:` is retained so users can find the plugin author; a dedicated plugin
page can be added back later via `Plugin URI:` once one exists.
#### 1.5.0
* Renamed: the plugin text domain and distribution folder are now `outscoreagent-
publisher` to match the WordPress.org slug. Internal storage keys (settings,
publish log) and the brand prefix on functions/classes are unchanged, so existing
installs keep their token and configuration after upgrading.
* Renamed: the admin settings page slug is now `?page=outscoreagent-publisher` (
was `?page=outscoreagent`). The “Settings” link on the Plugins page is updated
automatically; refresh any direct bookmarks.
#### 1.4.0
* Added: IndexNow route self-test on the Diagnostics tab. Click “Run probe now”
to hit the plugin’s own `/.txt` URL from inside WordPress and classify the
result (`ok`, `not_found`, `forbidden`, `wrong_body`, `redirected`, `server_error`,`
loopback_failed`). Each status comes with a one-line remediation hint so a customer
can tell whether a route failure is local (cache, WAF, hijacked hook) or external(
CDN, DNS, reverse proxy).
* Added: non-blocking advisories on the Settings tab for active plugins that frequently
interfere with the IndexNow route without owning IndexNow themselves — page caches(
WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed, Cache Enabler) and security/
WAF plugins (Wordfence, iThemes Security, Sucuri, NinjaFirewall).
* Added: detection of other plugins/themes hooked on `template_redirect` at priority
<= 1, which could short-circuit the request before the IndexNow handler runs.
Surfaced only when the loopback probe is failing, to keep the page calm in the
happy path.
* Added: route-health signal. If `flush_rewrite_rules()` cannot install our rule(`.
htaccess` unwritable, mod_rewrite disabled, nginx misconfigured), a clear notice
now appears on the Settings tab instead of failing silently.
* Hardened: stored IndexNow key value is validated on read; a corrupted option
no longer produces a confusing “another key is being served” symptom in the loopback
probe.
#### 1.3.1
* Fixed: the “Text only — no clickable links” and “Disabled” image-credit modes
now also rewrite the credit in the stored post content, not only at front-end
render time. Previously the linked credit remained visible in the block editor,
REST API, and any theme/feed that bypasses the_content filter. Articles whose
figure-level marker class survived a Gutenberg edit are transformed at save time
on the next publish/update.
* Note: with this change, switching from “Text only” or “Disabled” to “Active links”
or “Active links (nofollow)” no longer takes effect retroactively — anchors stripped
at save time cannot be restored by the render-time filter. Re-publish the article
from the dashboard to restore links under the new mode.
#### 1.3.0
* Authenticated REST endpoints now accept a namespaced `X-OutscoreAgent-Token`
header in addition to `Authorization: Bearer`. The custom header sidesteps third-
party JWT auth plugins (e.g. “JWT Authentication for WP-API”) which intercept
any `Authorization: Bearer …` value and reject our `osk_` tokens with `jwt_auth_invalid_token`/“
Wrong number of segments” before our route handler can run. The OutscoreAgent
platform now sends the new header by default; the Bearer fallback is retained
for backwards compatibility.
#### 1.2.1
* Compatibility release tracking server-side fixes. Multi-organization users editing
site integrations and IndexNow keys are now correctly authorized via any of their
org memberships (previously could see “Site not found or access denied” when
their first listed org did not own the site). Plugin behaviour is unchanged —
the fix lives entirely on the OutscoreAgent platform — but the version bump is
published in lockstep so plugin and platform stay aligned in support diagnostics.
* Bumped Tested up to header to track the latest stable WordPress release.
#### 1.2.0
* Featured images are now downloaded into the WordPress media library by default
and set as the post’s native featured image. Themes and the block editor pick
them up automatically — no theme changes required.
* Added a “Download featured image to media library” toggle in the settings page.
When disabled, the previous behaviour (remote URL stored in `_thumbnail_ext_url`
post meta) is retained.
* Repeat syncs of the same article reuse the existing media library attachment
instead of re-downloading.
* Sideload failures fall back to the external-URL path so posts never end up without
an image reference.
* Added External services disclosure and privacy details to readme (WordPress.org
submission compliance).
* Raised minimum PHP version to 8.1.
#### 1.1.0
* Added HTTPS enforcement for outbound callback URLs (defense-in-depth).
* Added per-token rate limiting (30 requests/minute) on all authenticated REST
endpoints.
* Added “Settings” link on the Plugins page for quick access.
* Added Plugin URI and Author URI linking to outscoreagent.com.
#### 1.0.0
* Initial release.
* Secure bearer token authentication.
* REST API endpoint for article publishing.
* Structured admin error log.
* Full uninstall cleanup.
## Meta
* Version **1.5.3**
* Last updated **3 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.0 or higher **
* Tested up to **7.0**
* PHP version ** 8.1 or higher **
* Tags
* [AI](https://wordpress.org/plugins/tags/ai/)[articles](https://wordpress.org/plugins/tags/articles/)
[automation](https://wordpress.org/plugins/tags/automation/)[content](https://wordpress.org/plugins/tags/content/)
[publishing](https://wordpress.org/plugins/tags/publishing/)
* [Advanced View](https://wordpress.org/plugins/outscoreagent/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/outscoreagent/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/outscoreagent/reviews/)
## Contributors
* [ outscoreagent ](https://profiles.wordpress.org/outscoreagent/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/outscoreagent/)