One plugin for the jobs every WordPress site needs, instead of five or six:<\/p>\n\n
Each job is a module you switch on from the hub, and a module that is off registers nothing: none of its hooks run on the site. The modules:<\/p>\n\n
Everything above is free, on as many sites as you like. nexya Pro, sold on nexya.dev, adds three modules \u2014 nexya forms, Mailya for newsletters and a page cache \u2014 and the parts that do the repetitive work for you: suggested redirects and pattern rules, CSV import, a daily vulnerability pass and a file fingerprint with rollback, a two-step login, updates undone by themselves when they break the site, undo from the activity log, a second sending server and failure alerts for mail, a branded login screen and admin skin, banner appearance and consent service by service, scheduled database clean-up, orphan image sizes, folders in the media library, and longer log retention. The free version contains none of that code; nexya Pro is delivered by Freemius after purchase, and takes over from this plugin with the same settings.<\/p>\n\n
The plugin sends nothing to a third party by default. The features that reach the network, and what they send, are listed under External services below.<\/p>\n\n
Multisite networks are not supported. On a network the plugin stays switched off and says so.<\/p>\n\n
Nothing below runs unless you switch the matching module or option on. No data leaves the site by default, and the plugin sends no usage data anywhere.<\/p>\n\n
WPVulnerability (Security module, vulnerability watch).<\/strong> When you start a check from the Security screen, the plugin asks the public WPVulnerability API whether the installed plugins have known vulnerabilities. For each installed plugin, its slug is sent to www.wpvulnerability.net; nothing else about the site is sent. Nothing is sent until you start a check. Terms and privacy (legal notice of its publisher): https:\/\/www.robotstxt.es\/legal\/<\/p>\n\n WordPress.org checksums (Security module).<\/strong> While the Security module is on, once a day and when you press \"Check now\", the plugin asks api.wordpress.org \u2014 the same service WordPress uses for its own updates \u2014 for the checksums of the installed WordPress version, sending only that version number and the site language, then compares them with the core files on your server. Terms: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n IndexNow (SEO module, optional, off by default).<\/strong> Only if you switch it on, each time a page is published, updated or taken down its address is sent to api.indexnow.org, which shares it with the search engines that take part (Bing, Yandex, Seznam, Naver and others), along with the site's host name and the verification key the plugin serves at the root of your site. Nothing is sent while the site asks search engines not to index it, or runs on a local address. Terms: https:\/\/www.indexnow.org\/terms \u2014 Privacy (Microsoft, which runs the IndexNow service): https:\/\/www.microsoft.com\/en-us\/privacy\/privacystatement<\/p>\n\n Stripe (nexya forms, Payment module, optional, nexya Pro).<\/strong> Only once you switch the module on and enter your own Stripe secret key, a form with a payment field sends, when the visitor submits it, the amount, the currency, the name of the form, the visitor's e-mail address if the form asks for one, and the entry's number to api.stripe.com to open a Stripe Checkout page; the visitor then pays on Stripe's site. Stripe calls back the site's own webhook address to confirm the payment. Terms: https:\/\/stripe.com\/legal\/ssa \u2014 Privacy: https:\/\/stripe.com\/privacy<\/p>\n\n PayPal (nexya forms, Payment module, optional, nexya Pro).<\/strong> Only once you enter your own PayPal REST app credentials, a form with a payment field sends, when the visitor chooses PayPal, the amount, the currency, the name of the form and the entry's number to api-m.paypal.com (or api-m.sandbox.paypal.com in sandbox mode) to open a PayPal approval page; the visitor approves the payment on PayPal's site, and the site captures it when they come back. Terms: https:\/\/www.paypal.com\/legalhub\/home \u2014 Privacy: https:\/\/www.paypal.com\/myaccount\/privacy\/privacyhub<\/p>\n\n Patchstack (Security module, optional).<\/strong> Only if you enter your own Patchstack API key, the same check also asks api.patchstack.com, sending each installed plugin's slug and your key. Terms: https:\/\/patchstack.com\/terms-and-conditions\/ \u2014 Privacy: https:\/\/patchstack.com\/privacy-policy\/<\/p>\n\n E-mail delivery (E-mails module).<\/strong> When you pick an API provider instead of SMTP, the messages your site sends are handed to that provider's API: sender, recipients, subject, body and attachments, at the moment the message is sent. You choose the provider and enter its API key. The providers offered are Brevo (https:\/\/www.brevo.com\/legal\/termsofuse\/ \u2014 https:\/\/www.brevo.com\/legal\/privacypolicy\/), SendGrid (https:\/\/www.twilio.com\/en-us\/legal\/tos \u2014 https:\/\/www.twilio.com\/en-us\/legal\/privacy), Postmark (https:\/\/postmarkapp.com\/terms-of-service \u2014 https:\/\/postmarkapp.com\/privacy-policy), Resend (https:\/\/resend.com\/legal\/terms-of-service \u2014 https:\/\/resend.com\/legal\/privacy-policy), SMTP2GO (https:\/\/www.smtp2go.com\/terms\/ \u2014 https:\/\/www.smtp2go.com\/privacy\/), MailerSend (https:\/\/www.mailersend.com\/legal\/terms-of-service \u2014 https:\/\/www.mailersend.com\/legal\/privacy-policy), SendLayer (https:\/\/sendlayer.com\/terms-of-service\/ \u2014 https:\/\/sendlayer.com\/privacy-policy\/), Mandrill (https:\/\/mailchimp.com\/legal\/terms\/ \u2014 https:\/\/mailchimp.com\/legal\/privacy\/), Mailgun (https:\/\/www.mailgun.com\/legal\/terms\/ \u2014 https:\/\/www.mailgun.com\/legal\/privacy-policy\/), Elastic Email (https:\/\/elasticemail.com\/resources\/usage-policies\/terms-of-use \u2014 https:\/\/elasticemail.com\/resources\/usage-policies\/privacy-policy) and SparkPost (https:\/\/www.sparkpost.com\/policies\/tou\/ \u2014 https:\/\/www.sparkpost.com\/policies\/privacy\/).<\/p>\n\n Gmail and Microsoft 365 sending (E-mails module, optional).<\/strong> Only if you choose Google (Gmail, Workspace) or Microsoft 365 (Outlook) as the sending method and connect an account. When you press \"Connect\", your browser goes to accounts.google.com or login.microsoftonline.com, where you sign in and allow the site to send e-mail; the plugin then sends the authorisation code it gets back, with the client ID and secret you entered, to oauth2.googleapis.com or login.microsoftonline.com to obtain an access token, and renews that token there when it expires while the site is sending. No password is stored on the site. Each message the site sends then goes through smtp.gmail.com, or smtp.office365.com \/ smtp-mail.outlook.com, with its sender, recipients, subject, body and attachments, at the moment it is sent. Google \u2014 Terms: https:\/\/policies.google.com\/terms \u2014 Privacy: https:\/\/policies.google.com\/privacy. Microsoft \u2014 Terms: https:\/\/www.microsoft.com\/en-us\/servicesagreement \u2014 Privacy: https:\/\/www.microsoft.com\/en-us\/privacy\/privacystatement<\/p>\n\n Cloudflare (Cache module, optional).<\/strong> Only if you switch the Cloudflare option on and enter your zone ID and API token: each time the nexya cache is emptied, the plugin asks api.cloudflare.com to empty the cache of that zone, sending the zone ID, the token and, when only some pages changed, their addresses. Terms: https:\/\/www.cloudflare.com\/terms\/ \u2014 Privacy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/p>\n\n Form webhook (nexya forms, optional).<\/strong> Only if you enter an address in a form's settings, each entry of that form is sent, when it is submitted, to that address as JSON: the form's name and number, the entry's number and date, the page it was sent from, the site's address, and the answers with the label and type of each field. You choose the address (Zapier, Make, n8n, a CRM\u2026); the plugin contacts no address you did not enter, and the terms and privacy policy that apply are those of the service you chose.<\/p>\n\n AI suggestions (optional).<\/strong> The plugin calls no AI provider itself. When you press a button that asks for a suggestion (a title, a description, an image text\u2026), the text needed for it is handed to the AI client built into WordPress, which sends it to the provider of the connector you set up in WordPress, under that provider's terms. Without such a connector, these buttons do not appear and nothing is sent.<\/p>\n\n Audience measurement tags (SEO module).<\/strong> If, and only if, you enter an ID or an address for one of them, the module prints that service's tag on the front end; the visitor's browser then loads the script from the service and sends it what that tag collects.\n* Google Tag Manager and Google Analytics 4, from www.googletagmanager.com. Terms: https:\/\/marketingplatform.google.com\/about\/analytics\/terms\/us\/ \u2014 Privacy: https:\/\/policies.google.com\/privacy\n* Plausible, from plausible.io or the address you enter. Terms: https:\/\/plausible.io\/terms \u2014 Privacy: https:\/\/plausible.io\/privacy\n* Umami, from the address of your own Umami instance or Umami Cloud. Terms: https:\/\/umami.is\/terms \u2014 Privacy: https:\/\/umami.is\/privacy\n* Matomo, from the address of your own Matomo instance or Matomo Cloud. Terms: https:\/\/matomo.org\/matomo-cloud-terms-of-service\/ \u2014 Privacy: https:\/\/matomo.org\/privacy-policy\/<\/p>\n\n Freemius (trial and purchase of nexya Pro).<\/strong> The Freemius SDK ships with the plugin in anonymous mode: on its own it sends nothing and shows no opt-in. Only when an administrator starts the Pro trial or buys nexya Pro from the plugin's screens are the site address, the WordPress, PHP and plugin versions and the administrator's name and e-mail address sent to Freemius, which handles the checkout and the licence. Terms: https:\/\/freemius.com\/terms\/ \u2014 Privacy: https:\/\/freemius.com\/privacy\/<\/p>\n\n Lists of known hosts (Cookies and Security modules).<\/strong> These are not remote files and nothing is loaded from them. The cookie module carries a list of third-party hostnames (Google Fonts, Font Awesome, public CDNs, YouTube, Google Maps and so on) as plain data: a script or frame already on your page whose address matches one of them is held back until the visitor consents. The Security module carries a similar list of well-known origins, offered as ready-made lines when you write your site's content security policy, the header that tells browsers which origins your pages may load from. Both lists are plain data files, modules\/Cookie\/data\/hosts.json and modules\/Security\/data\/origins.json. The plugin itself never contacts any of these hosts.<\/p>\n\n Requests to your own site.<\/strong> The cookie scan, the sharing-image finder of the SEO module and a few background jobs fetch pages of your own site from your own server. Nothing leaves it.<\/p>\n\n The plugin's own JavaScript and CSS ship unminified, as written.<\/p>\n\n\n Almost nothing. The registry declares them all, but only boots the modules that are on: the others register no hooks, load no assets and run no queries.<\/p><\/dd>\n Encrypted with AES-256-GCM in a single option, under a key derived from your WordPress salts. If you rotate those salts the stored secrets can no longer be read, and the panel tells you to enter them again.<\/p><\/dd>\n The licence is handled by Freemius: the key, its activation and the checkout live in the Freemius screens under the nexya menu. The plugin stores nothing about it.<\/p><\/dd>\n You choose, when you deactivate the plugin (or in Settings \u203a If the plugin is deleted):<\/p>\n\n Yes, in Translate \u203a Import, after a backup and ideally on a copy of the site first. Languages, versions of contents, terms, menus, strings and forms come over; the former plugin is only switched off, so switching it back on restores the site. The addresses keep their shape, and those that change are redirected (301) through the Redirects module.<\/p>\n\n Not taken over: prices per currency from WooCommerce Multilingual, a domain or subdomain per language (redirect it at the host), translated media files, and add-ons that need WPML or Polylang themselves. Image alternative texts are translated in Texts \u203a Images.<\/p><\/dd>\n Install and activate nexya Pro while this plugin is still in place: both read the same settings, and Pro switches this version off. Then delete this version.<\/p><\/dd>\n\n<\/dl>\n\n\n Earlier versions: https:\/\/nexya.dev\/en\/whats-new\/<\/p>","raw_excerpt":"Cookie consent with Google Consent Mode, SMTP with mail log, redirects and 404s, captcha, security headers \u2014 one light plugin, modules you switch on.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/366931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=366931"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/nexyadev"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=366931"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=366931"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=366931"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=366931"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=366931"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=366931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Third-party libraries<\/h3>\n\n
\n
\n
wp-content\/plugins\/<\/code>.<\/li>\n\n
Does a module I turned off still cost anything?<\/h3><\/dt>\n
Where are SMTP passwords stored?<\/h3><\/dt>\n
And the licence?<\/h3><\/dt>\n
What happens when I uninstall?<\/h3><\/dt>\n
\n
Can I move from WPML or Polylang?<\/h3><\/dt>\n
How do I move to nexya Pro without losing my settings?<\/h3><\/dt>\n
1.3.7<\/h4>\n\n
\n
1.3.6<\/h4>\n\n
\n
1.3.5<\/h4>\n\n
\n
1.3.4<\/h4>\n\n
\n
1.3.3<\/h4>\n\n
\n
1.3.2<\/h4>\n\n
\n
1.3.1<\/h4>\n\n
\n
1.3.0<\/h4>\n\n
\n