{"id":361329,"date":"2026-09-02T12:05:18","date_gmt":"2026-09-02T12:05:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/absoluit-user-hub\/"},"modified":"2026-09-02T12:05:08","modified_gmt":"2026-09-02T12:05:08","slug":"absoluit-user-hub","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/absoluit-user-hub\/","author":23552380,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.1.1","stable_tag":"1.1.1","tested":"7.1","requires":"5.6","requires_php":"7.4","requires_plugins":null,"header_name":"Absoluit User Hub","header_author":"Absoluit","header_description":"Centralized user management system. Configure this site as a Master Dashboard to control users across your network, or as a Client Agent to be controlled securely.","assets_banners_color":"6e8db6","last_updated":"2026-09-02 12:05:08","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/absoluit.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":41,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.1.1":{"tag":"1.1.1","author":"absoluit","date":"2026-09-02 12:05:08","revision":3677946}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3678009,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3678009,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3678009,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3678009,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.1.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3678009,"resolution":"1","location":"assets","locale":"","width":1280,"height":720},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3678009,"resolution":"2","location":"assets","locale":"","width":1280,"height":720},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3678009,"resolution":"3","location":"assets","locale":"","width":1280,"height":720},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3678009,"resolution":"4","location":"assets","locale":"","width":1280,"height":720}},"screenshots":{"1":"The central Master Dashboard displaying connection status, quick actions, and the list of connected child sites."}},"plugin_section":[],"plugin_tags":[142729,2686,2461,23129,1917],"plugin_category":[51],"plugin_contributors":[278866],"plugin_business_model":[],"class_list":["post-361329","plugin","type-plugin","status-publish","hentry","plugin_tags-central-dashboard","plugin_tags-multi-site","plugin_tags-user-management","plugin_tags-user-control","plugin_tags-users","plugin_category-multisite","plugin_contributors-absoluit","plugin_committers-absoluit"],"banners":{"banner":"https:\/\/ps.w.org\/absoluit-user-hub\/assets\/banner-772x250.png?rev=3678009","banner_2x":"https:\/\/ps.w.org\/absoluit-user-hub\/assets\/banner-1544x500.png?rev=3678009","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/absoluit-user-hub\/assets\/icon-128x128.png?rev=3678009","icon_2x":"https:\/\/ps.w.org\/absoluit-user-hub\/assets\/icon-256x256.png?rev=3678009","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/absoluit-user-hub\/assets\/screenshot-1.png?rev=3678009","caption":"The central Master Dashboard displaying connection status, quick actions, and the list of connected child sites."},{"src":"https:\/\/ps.w.org\/absoluit-user-hub\/assets\/screenshot-2.png?rev=3678009","caption":""},{"src":"https:\/\/ps.w.org\/absoluit-user-hub\/assets\/screenshot-3.png?rev=3678009","caption":""},{"src":"https:\/\/ps.w.org\/absoluit-user-hub\/assets\/screenshot-4.png?rev=3678009","caption":""}],"raw_content":"<!--section=description-->\n<p>Absoluit User Hub is a powerful, secure, centralized user management system designed specifically for WordPress. It enables network administrators to manage user accounts (create, update, search, and delete) across multiple connected child sites from a single, centralized WordPress master dashboard.<\/p>\n\n<p>The system is distributed as a single unified plugin package that supports three active roles:\n1. <strong>Master Dashboard Mode<\/strong>: Run on your central administration site. Exposes the main \"User Hub\" dashboard menus, connection diagnostics, AJAX controllers, and custom database mapping.\n2. <strong>Client Agent Mode<\/strong>: Run on individual child nodes. Exposes custom REST API endpoints under a private namespace (<code>wp-user-hub\/v1<\/code>) protected by a strict multi-layer verification middleware.\n3. <strong>Both Mode<\/strong>: Runs both components simultaneously on a single WordPress installation (primarily used for local development and debugging).<\/p>\n\n<p>Upon first activation, the plugin resides in a safe, uninitialized state and prompts the administrator to select the site's role before loading any features.<\/p>\n\n<h4>Architecture Overview<\/h4>\n\n<ul>\n<li><strong>Central Dashboard (Master)<\/strong>: The administrator interacts with the dashboard UI to trigger user operations. The Master component dispatches secure, signed REST requests to connected child sites using WordPress HTTP APIs.<\/li>\n<li><strong>Child Nodes (Client)<\/strong>: Expose custom REST API endpoints. An authentication middleware verifies credentials, allowed IP addresses, timestamp drift boundaries, and duplicate nonces before modifying the local WordPress user database.<\/li>\n<\/ul>\n\n<h3>Security<\/h3>\n\n<p>Absoluit User Hub implements several security controls to protect your user database:\n* <strong>API Key Authentication<\/strong>: A high-entropy shared secret generated for each child site.\n* <strong>IP Allowlisting<\/strong>: Strict enforcement restricting REST API requests to whitelisted Master IPs.\n* <strong>Timestamp Drift Validation<\/strong>: Rejects requests where the server time difference exceeds 300 seconds to prevent outdated requests.\n* <strong>Nonce Validation<\/strong>: Caches request nonces via transients to block replay attacks.\n* <strong>HMAC-SHA256 Request Signing<\/strong>: Incoming request parameters are cryptographically signed using the shared secret API Key, ensuring payload integrity.\n* <strong>Primary Admin Protection<\/strong>: Hardcoded checks explicitly block the deletion of user ID 1 (Primary Administrator).<\/p>\n\n<p>Best Practices:\n* Always run WordPress over HTTPS.\n* Restrict Allowed Master IPs on the Client settings.\n* Keep WordPress and plugins updated.\n* Protect and rotate API keys regularly.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>absoluit-user-hub<\/code> directory to the <code>\/wp-content\/plugins\/<\/code> directory of your WordPress site.<\/li>\n<li>Activate the plugin through the 'Plugins' menu in WordPress.<\/li>\n<li>A notice will appear at the top of the admin dashboard asking you to select the plugin role:\n\n<ul>\n<li><strong>If configuring the central hub<\/strong>: Select <strong>Master Dashboard Mode<\/strong>. This will initialize the dashboard tables and show the <strong>User Hub<\/strong> sidebar menu.<\/li>\n<li><strong>If configuring a child node<\/strong>: Select <strong>Client Agent Mode<\/strong>. Go to <strong>Settings &gt; User Hub Client<\/strong> to copy the generated <strong>API Key<\/strong> and the <strong>REST API URL<\/strong>, and whitelist your Master server's IP address.<\/li>\n<li><strong>To change modes<\/strong>: Go to <strong>Settings &gt; User Hub Settings<\/strong> at any time to switch roles. Mode switching is non-destructive; all existing settings and database records are preserved.<\/li>\n<\/ul><\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20a%20wordpress%20multisite%20network%20to%20use%20this%3F\"><h3>Do I need a WordPress Multisite network to use this?<\/h3><\/dt>\n<dd><p>No. Absoluit User Hub is built specifically for independent WordPress installations. It does not require Multisite, letting you manage users across entirely different domains and servers.<\/p><\/dd>\n<dt id=\"how%20do%20i%20configure%20a%20child%20site%3F\"><h3>How do I configure a child site?<\/h3><\/dt>\n<dd><p>Activate the plugin on the child site, select <strong>Client Agent Mode<\/strong>, navigate to <strong>Settings &gt; User Hub Client<\/strong>, and configure the Allowed Master IPs (your central server's IP). Copy the API Key and REST API URL. Then log in to your central master site (configured in <strong>Master Dashboard Mode<\/strong>), go to <strong>User Hub &gt; Connected Sites<\/strong>, click <strong>Add Site<\/strong>, and paste the child site's URL and API Key.<\/p><\/dd>\n<dt id=\"what%20is%20the%20difference%20between%20master%20and%20client%20modes%3F\"><h3>What is the difference between Master and Client modes?<\/h3><\/dt>\n<dd><p>Master mode runs the administration controls, allowing you to view and manage users on other sites. Client mode is a passive agent that exposes endpoints allowing the Master Dashboard to read\/write user profiles securely.<\/p><\/dd>\n<dt id=\"can%20i%20switch%20modes%20later%3F\"><h3>Can I switch modes later?<\/h3><\/dt>\n<dd><p>Yes. Go to <strong>Settings &gt; User Hub Settings<\/strong> in your WordPress admin panel and choose a new active role. All database custom tables and client settings options are retained and preserved.<\/p><\/dd>\n<dt id=\"where%20do%20i%20find%20the%20client%20api%20key%3F\"><h3>Where do I find the Client API Key?<\/h3><\/dt>\n<dd><p>In Client Mode, go to <strong>Settings &gt; User Hub Client<\/strong> in your child site's WordPress admin panel. The API key is displayed in a password field. Click the eye icon to toggle visibility and copy the key.<\/p><\/dd>\n<dt id=\"what%20are%20allowed%20master%20ips%3F\"><h3>What are Allowed Master IPs?<\/h3><\/dt>\n<dd><p>Allowed Master IPs is a security setting on the Client agent. You specify the external IP address of your Master Dashboard server. Any request arriving from a different IP address will be immediately blocked.<\/p><\/dd>\n<dt id=\"how%20does%20authentication%20work%3F\"><h3>How does authentication work?<\/h3><\/dt>\n<dd><p>Authentication uses shared secret API keys and HMAC-SHA256 signature verification. Outgoing requests are signed with a hash generated using the API key, request body, nonce, and timestamp. The client re-calculates this hash to verify the integrity and origin of the request.<\/p><\/dd>\n<dt id=\"can%20i%20bulk%20import%20sites%3F\"><h3>Can I bulk import sites?<\/h3><\/dt>\n<dd><p>Yes. In Master mode, the Connected Sites panel includes a bulk import feature where you can paste lists of sites with names, URLs, and API keys separated by commas or pipes.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20deleting%20a%20user%20who%20owns%20posts%3F\"><h3>What happens when deleting a user who owns posts?<\/h3><\/dt>\n<dd><p>When deleting a user from the dashboard, you can choose to assign their existing posts to a fallback administrator on the child site, preventing orphaned content.<\/p><\/dd>\n<dt id=\"what%20wordpress%20and%20php%20versions%20are%20supported%3F\"><h3>What WordPress and PHP versions are supported?<\/h3><\/dt>\n<dd><p>This plugin requires WordPress 5.6 or later, and PHP 7.4 or later.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.1<\/h4>\n\n<ul>\n<li>Security: Enforced strict capability check (manage_options) on the Client settings page.<\/li>\n<li>Security: Sanitized user identifiers in REST API endpoints to block potential output injection.<\/li>\n<li>Fix: Adjusted client whitelisting so that leaving Allowed Master IPs blank disables IP checking instead of blocking connections.<\/li>\n<li>Fix: Prevented API Key from being overwritten to empty on Client settings saves by removing it from registration and using readonly display fields.<\/li>\n<li>Fix: Restructured Master sites database schema setup to be fully compliant with WordPress dbDelta formatting and self-healing initialization.<\/li>\n<li>Fix: Migrated dynamic inline stylesheets and JS styles to standard enqueued stylesheet files.<\/li>\n<li>Fix: Added robust support for HTTP_CF_CONNECTING_IP and HTTP_X_FORWARDED_FOR reverse proxy client IP detection.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Feature: Support for bulk importing child sites using CSV\/pipe-delimited values.<\/li>\n<li>Feature: Added real-time connection status check badge.<\/li>\n<li>Security: Enforced IP Whitelisting checks by default.<\/li>\n<li>Security: Implemented transient-based nonce tracking to block replay attacks.<\/li>\n<li>Security: Added strict role validation checks and string bounds checking.<\/li>\n<li>Integration: Consolidated Master and Client plugins into a single package with a secure role setup flow.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial stable release.<\/li>\n<\/ul>","raw_excerpt":"Centralized dashboard and client system to manage WordPress users across all your connected sites. Powered by Absoluit.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/361329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=361329"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/absoluit"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=361329"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=361329"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=361329"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=361329"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=361329"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=361329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}