{"id":359740,"date":"2026-09-08T09:28:47","date_gmt":"2026-09-08T09:28:47","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/siteself-connector\/"},"modified":"2026-09-08T09:28:36","modified_gmt":"2026-09-08T09:28:36","slug":"siteself-connector","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/siteself-connector\/","author":21039685,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.6.0","stable_tag":"0.6.0","tested":"7.1","requires":"5.6","requires_php":"7.4","requires_plugins":null,"header_name":"SiteSelf Connector","header_author":"Refact","header_description":"Connects this WordPress site to SiteSelf using authenticated, administrator-only REST API routes.","assets_banners_color":"","last_updated":"2026-09-08 09:28:36","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/siteself.com","header_author_uri":"https:\/\/refact.co","rating":0,"author_block_rating":0,"active_installs":0,"downloads":19,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.6.0":{"tag":"0.6.0","author":"refact","date":"2026-09-08 09:28:36","revision":3686296}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.6.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[5590,2353,569,732],"plugin_category":[52],"plugin_contributors":[228522],"plugin_business_model":[],"class_list":["post-359740","plugin","type-plugin","status-publish","hentry","plugin_tags-agency","plugin_tags-ai","plugin_tags-automation","plugin_tags-maintenance","plugin_category-performance","plugin_contributors-refact","plugin_committers-refact"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/siteself-connector.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>SiteSelf is a service that works on your WordPress site for you \u2014 updating\ncontent, adjusting your design, keeping an eye on things \u2014 and reports back in\nchat. This plugin is the part that lives on your site, and it exists so your\nagent can work on your theme and plugin files rather than content alone.<\/p>\n\n<p><strong>What it can do<\/strong><\/p>\n\n<ul>\n<li>Read and write files inside your themes and plugins folders<\/li>\n<li>Tell your agent how the site is built: WordPress and PHP versions, active\ntheme, installed plugins, and which company hosts the site<\/li>\n<li>Clear caches<\/li>\n<li>Keep a log of everything it did, readable under Tools \u2192 SiteSelf<\/li>\n<\/ul>\n\n<p><strong>What it will not do, by design<\/strong><\/p>\n\n<ul>\n<li>It never runs code that is sent to it. There is no remote code execution.<\/li>\n<li>It never reads credentials belonging to other services. It reads a short,\nfixed list of settings that describe how your site is built, and refuses\nanything that looks like a key, token or password.<\/li>\n<li>It writes only inside your themes and plugins folders. Both folders are\nresolved before anything is written, so <code>..\/<\/code> cannot climb out of them, and a\nfile that turns out to be a shortcut to somewhere else (a symlink) is refused\nrather than followed.<\/li>\n<li>It cannot edit files that WordPress itself would not let you edit. Whether a\nrequest is allowed is WordPress's decision, using the same permissions as its\nbuilt-in editors \u2014 so <code>DISALLOW_FILE_MODS<\/code>, <code>DISALLOW_FILE_EDIT<\/code>, a managed\nhost that switches file changes off, and multisite's rule that only a network\nadministrator may touch shared plugin files all apply here too.<\/li>\n<li>Before replacing a file it keeps a copy of the previous version, and it\nrefuses to save PHP that has a syntax error.<\/li>\n<\/ul>\n\n<p><strong>How access works<\/strong><\/p>\n\n<p>The plugin adds no new way into your site. Every request must come from a\nsigned-in WordPress user with the right permissions, using WordPress's own\napplication passwords \u2014 which you create, and can revoke at any time under\nUsers \u2192 Profile \u2192 Application Passwords. Deactivating this plugin stops file\naccess immediately.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects your site to <strong>SiteSelf<\/strong>, a service run by Refact at\nhttps:\/\/siteself.com. The plugin is the site-side half of that service and is\nnot useful without it.<\/p>\n\n<p>The plugin makes no outbound requests of its own. It sends nothing anywhere,\non any schedule. What it does is answer requests that SiteSelf makes to your\nsite, and it answers them only when they carry a signed-in WordPress user with\nadministrator permissions \u2014 an application password that you created and can\nrevoke.<\/p>\n\n<p><strong>What leaves your site when SiteSelf asks.<\/strong> A status request returns a\ndescription of how this site is built:<\/p>\n\n<ul>\n<li>your site's name, home address, admin address and language<\/li>\n<li>your WordPress and PHP version numbers<\/li>\n<li>every plugin installed, with its version and whether it is active<\/li>\n<li>your active theme, its version, and whether it is a child theme<\/li>\n<li>which company hosts the site, any must-use plugins that identify them, and\nwhether the host reports this as a staging copy<\/li>\n<li>the server software string and the file path WordPress is installed at<\/li>\n<li>how many published posts and pages you have<\/li>\n<li>whether this site permits file changes<\/li>\n<li>a public key this plugin creates for the site, so that moving to a new\ndomain does not look like a different site. The matching private key never\nleaves your server \u2014 not to SiteSelf, not in any request.<\/li>\n<\/ul>\n\n<p>Other requests return the contents of a file inside your themes or plugins\nfolders, a folder listing, or one of a short fixed list of WordPress settings\nthat describe how the site is built. Nothing else is readable, and anything\nwhose name looks like a key, token, secret or password is refused.<\/p>\n\n<p>Your site's content is not sent by this plugin. No visitor data, analytics or\npersonal data of your users is collected, sent or stored by it.<\/p>\n\n<p>Service terms: https:\/\/siteself.com\/terms\nPrivacy policy: https:\/\/siteself.com\/privacy<\/p>\n\n<!--section=installation-->\n<p>This plugin does nothing on its own. It is the site-side half of a service, so\nthere is a short setup after you activate it.<\/p>\n\n<ol>\n<li>Install and activate the plugin.<\/li>\n<li>Create an application password: <strong>Users \u2192 Profile \u2192 Application Passwords<\/strong>.\nGive it a name you will recognise, such as \"SiteSelf\", and copy the password\nWordPress shows you. It is shown once.<\/li>\n<li>Sign in at https:\/\/siteself.com and add this site, pasting in the site\naddress, your WordPress username and that application password.<\/li>\n<\/ol>\n\n<p>There are no settings to configure. <strong>Tools \u2192 SiteSelf<\/strong> shows what your agent\nhas done, the previous versions of any file it replaced, and a button that\ndisconnects the site.<\/p>\n\n<p>To stop it at any time: revoke the application password under your profile, or\ndeactivate the plugin. Either takes effect immediately.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"can%20i%20see%20what%20the%20agent%20has%20done%3F\"><h3>Can I see what the agent has done?<\/h3><\/dt>\n<dd><p>Yes. Tools \u2192 SiteSelf lists every action with a timestamp.<\/p><\/dd>\n<dt id=\"how%20do%20i%20stop%20it%3F\"><h3>How do I stop it?<\/h3><\/dt>\n<dd><p>Deactivate the plugin, or revoke the application password under your user\nprofile. Either one takes effect immediately.<\/p><\/dd>\n<dt id=\"does%20it%20work%20without%20the%20siteself%20service%3F\"><h3>Does it work without the SiteSelf service?<\/h3><\/dt>\n<dd><p>No. This plugin is the site-side half of a service at https:\/\/siteself.com.<\/p><\/dd>\n<dt id=\"can%20it%20edit%20files%20if%20my%20host%20has%20locked%20them%20down%3F\"><h3>Can it edit files if my host has locked them down?<\/h3><\/dt>\n<dd><p>No, and that is deliberate. It asks WordPress the same question WordPress asks\nbefore showing you its own file editors. If your host or your <code>wp-config.php<\/code>\nhas switched file changes off, this plugin is refused too, and your agent will\ntell you which setting stopped it.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.6.0<\/h4>\n\n<ul>\n<li>Closed a hole in the file rails. A file that was a shortcut to somewhere else\n(a symlink) could be written through, which meant a write inside your themes\nfolder could change a file outside it. Those are now refused. If you have\ndeliberately symlinked a theme or plugin file, your agent will now say it\ncannot write to it rather than quietly changing the file at the other end.<\/li>\n<li>File editing now uses exactly the permissions WordPress uses for its own\neditors. <strong>On a multisite network this is a real change<\/strong>: only a network\nadministrator can edit theme and plugin files now, because those folders are\nshared by every site on the network. A single-site administrator is\nunaffected. Sites whose host switches file changes off through a filter\nrather than a constant are now correctly refused as well.<\/li>\n<li>Tools \u2192 SiteSelf and your SiteSelf dashboard now report whether writes are\nactually permitted, rather than only whether the two <code>wp-config.php<\/code>\nconstants are set. The two can disagree, and it was the second one that was\nbeing shown.<\/li>\n<\/ul>\n\n<h4>0.5.0<\/h4>\n\n<ul>\n<li>Updates now come from WordPress.org, like every other plugin on your site.\nEarlier versions fetched their own updates from siteself.com because this\nplugin was not in the directory yet. Nothing changes on your Plugins screen \u2014\nthe update button is in the same place and works the same way.<\/li>\n<li>This is the last update that arrives from siteself.com. After it, your site\nchecks WordPress.org.<\/li>\n<\/ul>\n\n<h4>0.4.0<\/h4>\n\n<ul>\n<li>Your site can now tell SiteSelf who it is, so moving to a new domain no longer\nlooks like a different site. The plugin creates a key the first time SiteSelf\nasks about your site, and keeps it here. The private half never leaves your\nserver \u2014 not to SiteSelf, not in any request.<\/li>\n<li>Nothing else changes, and there is nothing to set up. If you move your site,\nrestore a backup, or your host makes a staging copy, SiteSelf can tell which\none is which instead of guessing from the address.<\/li>\n<li>Removing the plugin leaves the key in place, so reinstalling brings your site\nback as the same site. Disconnect, under Tools \u2192 SiteSelf, is what removes it.<\/li>\n<\/ul>\n\n<h4>0.3.0<\/h4>\n\n<ul>\n<li>Updates now arrive on your own Plugins screen. Earlier versions had no way to\ntell WordPress where newer copies live, so updating meant deleting the plugin\nand uploading a zip by hand. It is now an ordinary one-click update, and can\nbe turned on for automatic updates like any other plugin.<\/li>\n<\/ul>\n\n<h4>0.2.0<\/h4>\n\n<ul>\n<li>Renamed from \"Refact Agent Connector\" to \"SiteSelf Connector\", including the\nplugin folder and the REST namespace. WordPress treats a renamed plugin as a\ndifferent one, so this version had to be installed by hand alongside removing\nthe old one \u2014 the change in 0.3.0 exists so that never happens again.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>First release: status, file read\/write with backups, allowlisted settings\nreads, cache flush, and the activity log.<\/li>\n<\/ul>","raw_excerpt":"Lets your SiteSelf agent work on this site&#039;s theme and plugin files, with a log you can read and a one-click disconnect.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/359740","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=359740"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/refact"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=359740"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=359740"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=359740"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=359740"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=359740"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=359740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}