Title: SteadWeave Companion Author: Andrea Parenti Published: August 23, 2026 Last modified: August 23, 2026 --- Search plugins ![](https://ps.w.org/steadweave-companion/assets/banner-772x250.png?rev=3661933) ![](https://ps.w.org/steadweave-companion/assets/icon-256x256.png?rev=3661870) # SteadWeave Companion By [Andrea Parenti](https://profiles.wordpress.org/drepar/) [Download](https://downloads.wordpress.org/plugin/steadweave-companion.1.0.7.zip) * [Details](https://wordpress.org/plugins/steadweave-companion/#description) * [Reviews](https://wordpress.org/plugins/steadweave-companion/#reviews) * [Installation](https://wordpress.org/plugins/steadweave-companion/#installation) * [Development](https://wordpress.org/plugins/steadweave-companion/#developers) [Support](https://wordpress.org/support/plugin/steadweave-companion/) ## Description #### Free Forever: 1 website, complete monitoring **SteadWeave Free includes complete monitoring for one website, free forever. There is no trial period and no expiration.** SteadWeave Companion is the complete WordPress plugin, not a separate “Lite” or feature-locked edition. Paid plans are available when you need to monitor more websites. SteadWeave Companion is the lightweight WordPress-side connector for the SteadWeave external monitoring service. The Companion does not perform the central monitoring workload locally. After a WordPress administrator explicitly starts setup and confirms the external-service disclosure, the plugin connects the site to SteadWeave. After pairing, authenticated technical heartbeats let the service evaluate WordPress health, software versions, update availability and other website-assurance signals. The PHP, JavaScript, CSS, translations, documentation and bundled image assets distributed in this WordPress.org plugin package are licensed under GPLv2 or later. The SteadWeave name and source-identifying marks may also be protected by applicable trademark law; those trademark rights are separate from, and do not restrict, the GPL license granted for the copies of the bundled assets distributed with this plugin. See ` ASSET-LICENSE.txt` and `LICENSE.txt`. SteadWeave is a separate SaaS service. Service plans may differ by the number of websites that can be managed. The Companion does not hide premium PHP code or unlock local plugin functionality with a license key. #### What the Companion does * Provides a request-first secure pairing flow. * Creates a cryptographic installation identity used to verify control of the WordPress installation. * Stores issued access credentials locally using authenticated encryption when supported by the server. * Sends authenticated technical heartbeats only after pairing. * Advertises locally available Smart Fix capabilities to the paired service. * Receives bounded, authenticated Smart Fix commands only after pairing and only after an authorized SteadWeave account user explicitly requests Assisted Remediation. * Can update supported SEO metadata through Yoast SEO, Rank Math, AIOSEO or SEOPress when one supported provider is detected unambiguously. * Can replace exact verified HTTP hyperlink references in published WordPress post content without requiring an SEO plugin. * Verifies Smart Fix targets and current values, reports structured results, and supports bounded preflight and rollback safeguards. * Reports WordPress/PHP versions, plugin/theme inventory and update state, site URLs, limited server context and WordPress cron state used by the monitoring service. * Receives SteadWeave branding and the customer dashboard URL as part of authenticated service responses. * Provides connection diagnostics and an administrator-only recovery path. * Stops scheduled authenticated telemetry when pairing is reset or the plugin is deactivated. * Integrates with WordPress privacy-policy, personal-data export and personal-data erasure tools for the locally stored enrollment email. The plugin does not add analytics, advertising trackers, marketing pixels or public- site credits. The Companion does not download or execute arbitrary PHP or JavaScript from SteadWeave, does not install plugins or themes remotely, and does not expose a general-purpose remote code execution mechanism. ### External Service SteadWeave Companion relies on the external SteadWeave service. The official production endpoint is: https://app.steadweave.com/ No enrollment data or SteadWeave telemetry is sent merely by activating the plugin. The administrator must open the SteadWeave screen, review the disclosure and explicitly confirm the connection before the first enrollment request. The manual recovery path requires the same acknowledgement. During enrollment the plugin sends: * WordPress site URL and site name; * the email address entered by the administrator; * site locale; * Companion version; * installation UUID; * cryptographic enrollment material used to verify that the request originated from this WordPress installation. After pairing, authenticated heartbeats send technical website telemetry including: * WordPress and PHP versions; * WordPress core update availability; * installed plugin identifiers/files, names, versions, activation state and update availability; * active theme name, stylesheet identifier, version and update availability; * site URL and home URL; * site icon URL; * a limited server-software string; * multisite state; * WordPress cron state; * heartbeat timestamp; * Smart Fix capability availability and supported fixer names. Regular heartbeat telemetry does not include page or post content. The administrator-only manual recovery path sends one authenticated technical snapshot to verify candidate credentials before those credentials are stored locally. The SteadWeave server also receives normal network metadata, such as the source IP address, as part of operating the HTTPS service. #### Assisted Remediation / Smart Fix When an authorized SteadWeave account user explicitly requests Assisted Remediation, the paired service may include a bounded Smart Fix command in an authenticated heartbeat response. The command identifies the requested fixer, target page, expected current state, proposed value and command identifier. Commands are subject to local validation, expiry and anti-replay controls before a write can occur. Depending on the selected fixer and local capabilities, Smart Fix can: * update a meta description through one supported SEO provider; * update a self-referencing canonical URL through one supported SEO provider; * update an SEO title through one supported SEO provider; * replace exact verified `http://` hyperlink references with their corresponding` https://` references in published WordPress `post_content`. SEO-specific fixers are available only when one supported SEO provider is detected unambiguously. The HTTP-reference fixer does not require an SEO provider. After a Smart Fix attempt, the Companion posts a structured result to the authenticated SteadWeave remediation-result endpoint. Depending on the fixer, that result can include the target page URL, command UUID, provider, whether data changed, previous value, new value, preflight evidence, rollback state and validation details used to verify the requested action. To prevent replay of Smart Fix commands, the Companion keeps a bounded local command ledger containing sanitized remediation results for up to seven days. Disconnecting or uninstalling the Companion removes this local ledger. No public Companion REST endpoint provides a general remote content-write API. Smart Fix commands are accepted only through authenticated responses from the paired SteadWeave service and are limited to the fixers implemented in this plugin. Service information: * Service website: https://steadweave.com/ * Application: https://app.steadweave.com/ * Documentation: https://docs.steadweave.com/ * Privacy Notice: https://steadweave.com/privacy/ * Terms of Service: https://steadweave.com/terms/ * Support: https://steadweave.com/support/ On normal production installations, the Companion is pinned to the official SteadWeave application endpoint. Custom central URLs are available only for local/development/ staging environments or when the site owner deliberately enables the development override with `STEADWEAVE_COMPANION_ALLOW_CUSTOM_CENTRAL`. ### Privacy SteadWeave Companion adds suggested privacy-policy text to **Settings > Privacy** in WordPress. The suggested text describes enrollment data, regular technical heartbeat telemetry, Assisted Remediation commands, supported WordPress changes, the structured remediation results returned to SteadWeave and the bounded local Smart Fix anti-replay ledger retained for up to seven days. The plugin also registers with the WordPress personal-data exporter and eraser for the enrollment email stored locally by the Companion. Service-side monitoring and remediation data is controlled by the SteadWeave service and is described in the SteadWeave Privacy Notice. For service privacy information see https://steadweave.com/privacy/. ### Security * Production service communication requires HTTPS. * Production central-server selection is pinned to the official SteadWeave endpoint. * Enrollment callback endpoints use short-lived verification state, rate limits and cryptographic verification. * Enrollment completion HMAC authentication is performed by the REST route permission callback before the write callback can run. * Pairing access tokens are stored with Sodium secretbox when available, or AES- 256-GCM through OpenSSL as a fallback. * Remote responses used for onboarding, portal links and branding are restricted to the selected SteadWeave service host. * Smart Fix commands are limited to locally implemented fixers, include anti-replay and state-validation controls, and are not a general-purpose remote execution channel. * WordPress administrator actions require `manage_options` plus WordPress nonces. ## Screenshots [⌊Companion Control Panel for secure setup, explicit external-service disclosure and site connection.⌉⌊Companion Control Panel for secure setup, explicit external- service disclosure and site connection.⌉[ Companion Control Panel for secure setup, explicit external-service disclosure and site connection. [⌊SteadWeave Assurance overview showing centralized website-health monitoring after pairing.⌉⌊SteadWeave Assurance overview showing centralized website-health monitoring after pairing.⌉[ SteadWeave Assurance overview showing centralized website-health monitoring after pairing. ## Installation 1. Install and activate SteadWeave Companion. 2. Open **SteadWeave** in the WordPress administration menu. 3. Review the external-service disclosure and linked Privacy Notice and Terms of Service. 4. Enter the email address to use for setup notifications. 5. Explicitly confirm the external-service connection. 6. Select **Start secure setup**. 7. Complete the guided setup on app.steadweave.com. 8. Return to WordPress and verify that the connection status becomes **Connected**. No SteadWeave password, API token or secret credential needs to be copied by email during the normal pairing flow. ## FAQ ### Does the plugin send data immediately after activation? No. Activation creates local cryptographic installation material but does not contact SteadWeave. Scheduled authenticated heartbeats are enabled only after a valid pairing is completed. The first enrollment request is sent only after an administrator confirms the external-service disclosure. ### Which server does the production plugin connect to? The official production endpoint is https://app.steadweave.com/. A production installation cannot redirect normal SteadWeave traffic to an arbitrary server through the standard plugin interface. ### Why does the plugin expose REST enrollment endpoints? They are callback endpoints used by SteadWeave to verify control of the WordPress installation and complete pairing before normal service credentials exist. The proof endpoint is available only during a short enrollment window. Both callback paths are rate-limited, and enrollment completion is cryptographically authenticated in the route permission callback before the write callback is allowed to run. ### Can SteadWeave modify WordPress content? Only through the bounded Assisted Remediation features described above, after an authorized SteadWeave account user explicitly requests a supported Smart Fix. The Companion does not accept arbitrary code or arbitrary content-write commands. ### Is SteadWeave Companion a paid plugin? No. SteadWeave Companion is the complete GPLv2-or-later WordPress plugin and contains no hidden premium PHP functionality or separate Lite edition. SteadWeave Free provides complete monitoring for one website, free forever, with no trial period or expiration. Paid service plans are available when you need to monitor more websites. ### What happens if I disconnect the Companion? Local pairing credentials, synchronized connection state and the local Smart Fix anti-replay ledger are removed, and scheduled heartbeats are stopped. Data already held by the SteadWeave service is handled according to the service Privacy Notice and retention settings. ### Where can I find documentation? Documentation is published at https://docs.steadweave.com/. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SteadWeave Companion” is open source software. The following people have contributed to this plugin. Contributors * [ Andrea Parenti ](https://profiles.wordpress.org/drepar/) [Translate “SteadWeave Companion” into your language.](https://translate.wordpress.org/projects/wp-plugins/steadweave-companion) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/steadweave-companion/), check out the [SVN repository](https://plugins.svn.wordpress.org/steadweave-companion/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/steadweave-companion/) by [RSS](https://plugins.trac.wordpress.org/log/steadweave-companion/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.7 * Make the Free Forever offer prominent in the WordPress.org listing: complete SteadWeave monitoring for one website, with no trial period or expiration. * Clarify that SteadWeave Companion is the complete plugin, not a separate Lite or feature-locked edition. * Refresh the WordPress.org banner message to highlight the one-site Free Forever offer. * No functional behavior changes from 1.0.6. #### 1.0.6 * Add official WordPress.org screenshots and listing captions for the secure setup and Assurance dashboard flows. * Refresh public release metadata for the WordPress.org 1.0.6 tag. * No functional behavior changes from 1.0.5. #### 1.0.5 * Fix the WordPress admin menu icon regression by using a dedicated 20×20-pixel bundled icon instead of the full-size branding artwork. * Separate the admin-menu icon accessor from the dashboard/favicon branding icon so future branding changes cannot alter the menu icon dimensions. * Synchronize the Italian translation catalog with the final 1.0.5 source strings and translator context. * Clear the local Smart Fix anti-replay ledger and remediation diagnostics when pairing is reset, and document its bounded seven-day retention. * Verify secure enrollment-secret persistence before using newly generated enrollment material. * Bound SteadWeave HTTP response sizes and make loopback-host handling consistent across enrollment, heartbeat, remediation reporting and branding validation. #### 1.0.4 * Add the required translator context for the external-service URL placeholders in the WordPress privacy-policy text. #### 1.0.3 * Removed pre-public-release storage, cryptography and REST compatibility shims so the WordPress.org package uses only the canonical SteadWeave Companion identifiers and REST namespace. * Clarified that all bundled plugin assets, including the shipped logo and icon copies, are GPLv2 or later while trademark rights remain separate. * Scoped Companion branding, palette styling and favicon changes to the SteadWeave admin screen; the WordPress admin menu uses the bundled local icon. * Removed synchronous branding HTTP requests from WordPress administration requests. Branding is synchronized only through authenticated service responses such as enrollment and heartbeat traffic. * Moved enrollment-completion payload-size and HMAC authentication checks into the REST `permission_callback` before the write callback executes. * Expanded the external-service and WordPress privacy disclosures to document all supported Smart Fix operations and remediation-result data. * Clarified that Smart Fix does not download arbitrary executable code, install extensions or provide a general-purpose remote code execution mechanism. * Removed per-request cron schedule repair from `init`; schedules are managed at activation, successful pairing, reset and deactivation boundaries. * Reformatted review-sensitive PHP for human readability and cleaned the public changelog to published 1.x releases only. #### 1.0.2 * Updated the WordPress.org `Tested up to` declaration to WordPress 7.1. * Prefixed the uninstall loop variable to satisfy WordPress global naming conventions. * Replaced the dynamic filter-name invocation in product URL resolution with explicit prefixed filter hooks. #### 1.0.1 * Aligned the gettext text domain with the `steadweave-companion` WordPress.org slug. * Replaced short global identifiers with collision-safe SteadWeave Companion namespaces, constants, options and hooks. * Replaced directly emitted admin CSS with WordPress enqueue APIs and context-appropriate output escaping. #### 1.0.0 * Initial public SteadWeave Companion release. ## Meta * Version **1.0.7** * Last updated **14 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.5 or higher ** * Tested up to **7.1** * PHP version ** 8.1 or higher ** * Tags * [telemetry](https://wordpress.org/plugins/tags/telemetry/)[uptime](https://wordpress.org/plugins/tags/uptime/) [website monitoring](https://wordpress.org/plugins/tags/website-monitoring/)[wordpress health](https://wordpress.org/plugins/tags/wordpress-health/) * [Advanced View](https://wordpress.org/plugins/steadweave-companion/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/steadweave-companion/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/steadweave-companion/reviews/) ## Contributors * [ Andrea Parenti ](https://profiles.wordpress.org/drepar/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/steadweave-companion/)