IoT Data Widget – Home Assistant, MQTT & Smart Home Sensors

blocks/iot-widget/build/index.js (the Gutenberg block editor script) is a compiled bundle. Its full, human-readable source is included in this plugin's ZIP at blocks/iot-widget/src/ — build it yourself with npm install && npm run build (standard @wordpress/scripts toolchain, see package.json).

Card (single value): [iotdw_widget connection="Home" entity="sensor.living_room_temperature"] Status list (several entities at once): [iotdw_widget connection="Home" style="list" entities="sensor.temperature,sensor.humidity,sensor.battery"] Status list with your own labels (in the order of the entities; leave one empty to keep the device's name): [iotdw_widget connection="Home" style="list" entities="sensor.temperature,sensor.humidity" labels="Living room,Humidity"] Gauge (numeric value with a min/max range): [iotdw_widget connection="Home" style="gauge" entity="sensor.tank_level" min="0" max="100"] Generic REST (entity is a JSONPath into the JSON response): [iotdw_widget connection="Weather API" entity="current_weather.temperature"]

Yes — add status rules. In the block, open Status rules in the sidebar; in a shortcode, use the states attribute. Each rule is condition:text:colour, rules are separated by ;, up to 5 per widget, and the first matching rule wins:

• A relay: [iotdw_widget connection="Home" entity="switch.pump" states="0:Off:red;1:Running:green"]
• Temperature thresholds, keeping the number and adding only a colour dot: states="..18::grey;18..24::green;24..::red"

Yes, every wizard screen has a "Skip the wizard, I'll configure manually" link that takes you straight to the regular Connections page, where everything works exactly as it did before the wizard existed. Nothing about manual configuration changed or was removed.

Yes — click "Run the setup wizard again" on the Connections page. It always creates a brand-new connection through the same guided steps; it never edits or overwrites one you already have.

If you activated several plugins at once (the "bulk actions" checkbox list on the Plugins screen), the wizard intentionally doesn't open — a redirect in the middle of a bulk action would be disruptive. Open it anytime from IoT Data Widget → Setup Wizard in the admin menu.

In Home Assistant, click your username in the bottom-left corner to open your profile, scroll to Security, then Long-Lived Access Tokens → Create Token. Copy it immediately — Home Assistant only shows it once. Home Assistant doesn't let you limit what a token can do — it inherits the full permissions of whichever account created it, and it never expires until you revoke it. We recommend creating a separate, non-administrator account in Home Assistant just for this token. If your WordPress site is on external/shared hosting, also consider push mode instead — it never stores a Home Assistant token at all.

Credentials you enter (Home Assistant tokens and Generic REST authorization headers — plus, in Pro, MQTT broker passwords and Shelly Cloud keys) are encrypted before being stored in your WordPress database, using a key derived from your site's own configuration. This protects them if the database itself leaks — a backup, a database dump, a SQL injection in an unrelated plugin on the same install, or a staging clone. It does not protect against someone who has already fully compromised your server, since the encryption key lives on that same server. If you ever uninstall the plugin, we recommend also revoking the Home Assistant token (and rotating any other credentials you entered) from the device/service side. Push mode sidesteps this entirely: the plugin never stores any credentials to your devices, because your device sends data to the plugin instead of the other way around.

For security, the plugin doesn't connect to local network addresses (like 192.168.x.x or homeassistant.local) unless you allow it. If WordPress runs on the same network as your devices — a Raspberry Pi, NAS or home server — turn on IoT Data Widget → Settings → Allow local network addresses (on a multisite network, only a network administrator can). Choosing "Same network as my devices" in the setup wizard does this for you. If your site is hosted externally, use push mode instead: it can't reach your home network anyway.

Both. The Generic REST connector (free) works with any API that returns JSON over HTTP(S), authenticated or not.

No. The values shown in your widgets never leave your own WordPress installation to any third party — the plugin only connects to the URL you configure in each connection. See "External services" in the description for the small number of exceptions.

The widget fails gracefully: site visitors simply see nothing where the widget would be, while logged-in administrators see a clear error message in its place.

No — responses are cached for 60 seconds by default (not configurable per widget in this version), so repeated page views within that window are served from cache.

Go to IoT Data Widget → Diagnostics and click "Copy diagnostic report", then paste it into your support email or ticket. Tokens, keys and passwords are never included in the report.

English (default) and Polish. The Polish translation is included in the plugin and loads automatically on WordPress 6.7 or newer when your site language is Polish. Other languages can be contributed on translate.wordpress.org — any string not yet translated falls back to English.

No telemetry beyond the opt-in Freemius diagnostics (see "External services" in the description); the plugin author never sees your data or connection details. Credentials are encrypted at rest. Fetched values are cached temporarily (WP Transients, 60s default), not logged or retained beyond that. Uninstalling leaves your data in place unless you check "Remove all plugin data" under Settings first. If the external API/instance you connect to processes personal data, your site's own privacy policy should disclose that connection.