Atomic Site Manager

Atomic Site Manager is a connector plugin. It links this WordPress site to an Atomic Site Manager account so you can manage the site from one external dashboard instead of logging in to wp-admin for every routine task. The plugin adds no dashboard, charts, or reporting screens to WordPress. Inside WordPress it shows a single settings page where you paste your Site Key and connect. Everything else happens in the Atomic Site Manager web app. The connector requires an Atomic Site Manager account. Without a Site Key from that service the plugin stays idle and does nothing. Create an account and register your site at https://atomicsitemanager.com/ What the connector does

• Registers this site with your Atomic Site Manager account using a Site Key you paste yourself
• Sends a periodic heartbeat with site inventory and health data
• Polls for commands you queue in the dashboard and runs them on this site
• Reports each command result back to the dashboard
• Clears its stored credentials automatically when you disconnect the site from the dashboard

What you can run from the dashboard

• Install, update, activate, deactivate, and delete plugins and themes. Installs come from the WordPress.org directory by slug; the connector does not install packages from any other source.
• Update WordPress core and translations
• Create, edit, and delete users and roles
• Read and update options, browse database tables, and flush caches
• Create, restore, and delete database and uploads backups stored on this server
• Take, compare, and restore configuration snapshots
• Run reset tools for options, users, roles, sessions, and media
• Apply security hardening settings and run performance audits
• Manage SEO titles, descriptions, and social metadata
• Run static plugin checks against installed plugins
• Toggle background updates and traffic-triggered WP-Cron spawning
• Open a one-click admin login from the dashboard for users you authorize there

Built-in engines SEO output, reset and snapshot tooling, and static plugin checking are built into the connector, so you do not need separate plugins for them. All three ship switched off: until you turn the SEO engine on from the dashboard, the connector adds no titles, meta tags, schema, feed text, or sitemap URLs to your site. The connector never activates or deactivates a plugin or theme on its own. It only does so when you run that specific command from your dashboard, and it never touches its own activation state. External services This plugin relies on two external services. Both are described below, including what is sent, when it is sent, and the conditions under which it happens. 1. Atomic Site Manager (required) Atomic Site Manager is a software-as-a-service dashboard for managing WordPress sites remotely, operated by Oyorox. This plugin is the connector for that service: it registers the site, reports its state, and carries out the commands you queue in the dashboard. Without it the plugin has nothing to talk to.

• Service home: https://atomicsitemanager.com/
• Dashboard you sign in to: https://atomic-site-manager-web.vercel.app
• API endpoint the plugin calls: https://atomic-site-manager-api.vercel.app/api/v1/connector/
• Terms of use: https://atomicsitemanager.com/terms-of-use.html
• Privacy policy: https://atomicsitemanager.com/privacy-policy.html

When data is sent Nothing at all is sent until you paste a Site Key on Settings → Atomic Site Manager and click Connect. After that:

• On connect — once, when you submit your Site Key
• On heartbeat — every 60 seconds by default, via WP-Cron, and whenever you press Send heartbeat now
• On command result — after the dashboard runs a command on this site
• On magic login — once per one-click login, to verify the token you were issued
• On disconnect — once, when you disconnect from the settings page

What is sent

• Site name, site URL, home URL, locale, timezone, and whether the install is multisite
• WordPress, PHP, MySQL, and web server versions, and whether WP_DEBUG and SSL are on
• Installed plugins and themes with names, slugs, versions, authors, and active state
• Available core, plugin, theme, and translation updates
• Memory usage and limit, disk usage and free space, the uploads directory path, and the active theme
• WordPress user accounts and roles, including user login, email address, display name, assigned roles, and registration date, for up to 200 users
• Command results and error messages produced by dashboard actions
• Your Site Key and the site token issued in exchange for it

The plugin does not send post content, comments, media files, passwords, or visitor analytics. All requests use HTTPS. Plain HTTP is accepted only for localhost and private LAN addresses so the plugin can be developed against a local backend. 2. IndexNow (optional, off by default) IndexNow is a search-engine notification protocol sponsored by Microsoft Bing, Yandex, Seznam.cz, Naver, and Yep. The plugin can ping it so newly published content is discovered quickly instead of waiting for the next crawl.

• Service: https://www.indexnow.org/
• API endpoint the plugin calls: https://api.indexnow.org/indexnow
• Terms and conditions, including how request data is handled: https://www.indexnow.org/terms

When data is sent Only when all three of the following are true, all of which are off or empty until you set them from the Atomic Site Manager dashboard: the SEO engine is enabled, IndexNow and instant indexing are enabled, and an IndexNow key is set. When they are, one request is sent each time a post moves into the published status for the first time. Nothing is sent on a default install. What is sent

• This site's hostname
• The permalink of the post that was just published
• Your IndexNow key, and the URL of the key verification file on this site

No personal data, post content, or visitor data is sent to IndexNow. Bundled third-party assets The admin settings screen uses three webfonts, all bundled with the plugin and served from this site — no CDN or external font service is contacted. Each is licensed under the SIL Open Font License 1.1, with the full licence text in assets/fonts/:

• DM Sans — Copyright 2014 The DM Sans Project Authors
• Fraunces — Copyright 2018 The Fraunces Project Authors
• IBM Plex Mono — Copyright 2017 IBM Corp.

1. Install the plugin through Plugins → Add New, or upload the atomic-site-manager folder to /wp-content/plugins/.
2. Activate Atomic Site Manager from the Plugins screen.
3. Sign in to the Atomic Site Manager dashboard at https://atomic-site-manager-web.vercel.app, create a site, and copy its Site Key.
4. In WordPress, go to Settings → Atomic Site Manager.
5. Paste the Site Key and click Connect.

The site registers with the service and begins sending heartbeats. Use Disconnect on the same screen to revoke the connection and clear the stored credentials. To point a staging or local install at a different backend, define the URLs in wp-config.php before WordPress loads plugins: define( 'ASMS_SERVER_URL', 'https://api-staging.example.com' ); define( 'ASMS_DASHBOARD_URL', 'https://app-staging.example.com' );

1.0.2

• Plugin and theme installs now come from the WordPress.org directory only. Package URLs pointing anywhere else are refused instead of downloaded, in remote install commands and in collections alike. Saved collections store a slug and no longer keep a package URL.
• Restoring a backup writes only inert media files into the uploads directory. PHP and other executable files, .htaccess, web.config and dotfiles inside the archive are refused and reported instead of being written.
• Stored credentials are never returned to the dashboard. Option reads, option listings, the database browser and option exports redact API keys — including WordPress core connector and AI provider keys — tokens, passwords, salts and licence keys.
• Remote option writes and deletes now refuse WordPress' structural settings. active_plugins, template and stylesheet are protected, so activating a plugin or switching a theme stays a user action, and keys, salts and other plugins' credentials can no longer be overwritten or removed.
• The database tools stay inside this installation's own tables, so a database shared with another WordPress install is no longer reachable.
• The plugin-data reset no longer matches option names from short or generic plugin slugs, and skips protected options instead of deleting them.

1.0.1

• The built-in SEO engine now ships switched off. A fresh install no longer alters titles, head markup, image alt text, feed content, robots.txt, or permalinks until you enable the engine from the dashboard.
• Bundled the admin screen's webfonts with the plugin instead of loading them from Google Fonts, so no external asset request is made.
• Security response headers are now controlled by their own hardening toggle instead of being sent on every request.
• Documented the optional IndexNow integration and both external services in full, with terms and privacy links.

1.0.0

• Initial release.
• Site Key connection, disconnect, and automatic credential clearing when the service revokes a site.
• WP-Cron heartbeat with site inventory, update availability, and health metrics.
• Remote command runner for plugins, themes, core, translations, users, roles, options, database tables, and caches.
• Database and uploads backups, configuration snapshots, and reset tools.
• Built-in SEO, reset/snapshot, and static plugin-check engines, all off until enabled from the dashboard.
• Security hardening controls, performance audits, and automation toggles for background updates and WP-Cron spawning.
• REST status endpoints under the siteconnector/v1 namespace.