IoT Data Widget

blocks/iot-widget/build/index.js (the Gutenberg block editor script) is a compiled bundle. Its full, human-readable source is included in this plugin's ZIP at blocks/iot-widget/src/ — build it yourself with npm install && npm run build (standard @wordpress/scripts toolchain, see package.json).

Free (no time limit, no license, unlimited connections): Home Assistant, push mode, Generic REST data sources; Card/Status list/Gauge display styles; the setup wizard, shortcode, Gutenberg block, and diagnostics page. Pro adds:

• More data sources — device presets for Shelly, Tasmota and ESPHome (pick the device, enter its IP, no JSONPath needed; Shelly Gen1 and ESPHome presets are in beta), Shelly Cloud, and MQTT (polled every 2 minutes, or real-time with the optional server-side listener, which requires SSH access).
• History graphs — Chart and Mini trend (sparkline) display styles, plus Grid for entities from different connections in one widget.
• Alerts and reports — email or webhook alerts when a value crosses a threshold, and recurring email reports with min/max/average.
• Embed and export — a token-protected public embed page without the site theme, and CSV export of recorded history.
• Manually tracked entities — history and alerts for widgets placed outside post content, e.g. in theme templates.

Card (single value): [iotdw_widget connection="Home" entity="sensor.living_room_temperature"] Status list (several entities at once): [iotdw_widget connection="Home" style="list" entities="sensor.temperature,sensor.humidity,sensor.battery"] Gauge (numeric value with a min/max range): [iotdw_widget connection="Home" style="gauge" entity="sensor.tank_level" min="0" max="100"] Generic REST (entity is a JSONPath into the JSON response): [iotdw_widget connection="Weather API" entity="current_weather.temperature"] Entities with a non-numeric state (a relay's on/off, a presence sensor's home/away...) show their real state ("ON", "home") in Card and Status list styles; a raw true/false from a JSON API shows as "On"/"Off".

Yes, every wizard screen has a "Skip the wizard, I'll configure manually" link that takes you straight to the regular Connections page, where everything works exactly as it did before the wizard existed. Nothing about manual configuration changed or was removed.

Yes — click "Run the setup wizard again" on the Connections page. It always creates a brand-new connection through the same guided steps; it never edits or overwrites one you already have.

If you activated several plugins at once (the "bulk actions" checkbox list on the Plugins screen), the wizard intentionally doesn't open — a redirect in the middle of a bulk action would be disruptive. Open it anytime from IoT Data Widget → Setup Wizard in the admin menu.

In Home Assistant, click your username in the bottom-left corner to open your profile, scroll to Security, then Long-Lived Access Tokens → Create Token. Copy it immediately — Home Assistant only shows it once. Home Assistant doesn't let you limit what a token can do — it inherits the full permissions of whichever account created it, and it never expires until you revoke it. We recommend creating a separate, non-administrator account in Home Assistant just for this token. If your WordPress site is on external/shared hosting, also consider push mode instead — it never stores a Home Assistant token at all.

Credentials you enter (Home Assistant tokens and Generic REST authorization headers — plus, in Pro, MQTT broker passwords and Shelly Cloud keys) are encrypted before being stored in your WordPress database, using a key derived from your site's own configuration. This protects them if the database itself leaks — a backup, a database dump, a SQL injection in an unrelated plugin on the same install, or a staging clone. It does not protect against someone who has already fully compromised your server, since the encryption key lives on that same server. If you ever uninstall the plugin, we recommend also revoking the Home Assistant token (and rotating any other credentials you entered) from the device/service side. Push mode sidesteps this entirely: the plugin never stores any credentials to your devices, because your device sends data to the plugin instead of the other way around.

For security, the plugin doesn't connect to local network addresses (like 192.168.x.x or homeassistant.local) unless you allow it. If WordPress runs on the same network as your devices — a Raspberry Pi, NAS or home server — turn on IoT Data Widget → Settings → Allow local network addresses (on a multisite network, only a network administrator can). Choosing "Same network as my devices" in the setup wizard does this for you. If your site is hosted externally, use push mode instead: it can't reach your home network anyway.

Both. The Generic REST connector (free) works with any API that returns JSON over HTTP(S), authenticated or not.

No. The values shown in your widgets never leave your own WordPress installation to any third party — the plugin only connects to the URL you configure in each connection. See "External services" below for the small number of exceptions.

The widget fails gracefully: site visitors simply see nothing where the widget would be, while logged-in administrators see a clear error message in its place.

No — responses are cached for 60 seconds by default (not configurable per widget in this version), so repeated page views within that window are served from cache.

Go to IoT Data Widget → Diagnostics and click "Copy diagnostic report", then paste it into your support email or ticket. Tokens, keys and passwords are never included in the report.

English by default. Additional languages are provided via translate.wordpress.org — any string not yet translated falls back to English.

No telemetry beyond the opt-in Freemius diagnostics (see "External services" below); the plugin author never sees your data or connection details. Credentials are encrypted at rest. Fetched values are cached temporarily (WP Transients, 60s default), not logged or retained beyond that. Uninstalling leaves your data in place unless you check "Remove all plugin data" under Settings first. If the external API/instance you connect to processes personal data, your site's own privacy policy should disclose that connection.