KOZ Site Bridge
| 开发者 | ramirkz |
|---|---|
| 更新时间 | 2026年10月19日 21:42 |
| 捐献地址: | 去捐款 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
KOZ Site Bridge is an independent WordPress plugin developed and maintained by Tony Kozyriev. It grew from production tooling used on the UA FREE charitable foundation website.
Features:
- authenticated read-only REST diagnostics;
- canonical KOZ REST namespace and X-KOZ-Key authentication;
- backward-compatible legacy endpoint and header during migration;
- HMAC API keys with one-time display;
- no persistent API request log, IP storage or User-Agent storage;
- safe same-site public frontend HTTP probes without query strings;
- allowlisted Googlebot and AdsBot User-Agent profiles;
- redirect-chain and selected Cloudflare/server headers;
- rendered public-page audit for title, description, canonical, robots, hreflang, headings, image alt state, links, schema and document language;
- sitemap inventory and batched sitemap audit with concrete per-URL findings;
- privacy-safe KOZ 404 Guard integration;
- KOZ Suite inventory and navigation;
- multilingual administration with English fallback;
- no arbitrary URL input and no content, plugin, theme or user modifications.
- The X-KOZ-Key is generated locally by the site administrator and is used only to authenticate the read-only REST API. It does not control feature availability.
- Every built-in plugin feature is available to every installation.
- The authenticated API has a security/abuse throttle of 120 successful requests per hour per key. This protects the WordPress site and applies equally to all authenticated clients.
- The OpenAPI schema endpoint is intentionally public so an administrator can import the schema into a REST client. It exposes only the API contract and does not return private site data, credentials, settings, content, or logs. All diagnostic data endpoints require X-KOZ-Key authentication.
- KOZ Site Bridge does not connect to an external processing service. Its HTTP probes are restricted to the current WordPress site. External REST clients or automation tools are optional and chosen by the site administrator.
安装:
- If the legacy UA FREE Site Bridge plugin is active, deactivate it manually and keep it installed until verification is complete. KOZ Site Bridge does not deactivate other plugins automatically.
- Upload and activate the KOZ plugin ZIP.
- Open KOZ Suite > Site Bridge.
- Verify the existing key or rotate it, then test Ping and OpenAPI.
更新日志:
0.5.7
- Removed automatic deactivation of the legacy UA FREE Site Bridge plugin; activation state remains under administrator control.
- Replaced the generic public REST permission callback on the OpenAPI schema with an explicit plugin callback documenting the intentionally public, schema-only endpoint.
- Clarified that X-KOZ-Key is a local authentication credential, does not control feature availability, and that the hourly request throttle is security/abuse protection only.
- No diagnostic endpoint was made public; all site-data endpoints remain authenticated.
- Updated WordPress compatibility metadata for WordPress 7.1.
- No functional or API behavior changes.
- Replaced direct PHP log file handles with the WordPress Filesystem API for Plugin Check compliance.
- Preserved the read-only admin error-log endpoint, fixed candidate allowlist and privacy redaction.
- No changes to API keys, routes or existing diagnostics behavior.
- Added an authenticated read-only admin error-log diagnostic endpoint for private troubleshooting.
- Reads only fixed WordPress/PHP log candidates, never an arbitrary path supplied by the caller.
- Redacts credentials, cookies, email addresses and local filesystem prefixes before returning recent log lines.
- Preserved all existing Site Bridge endpoints, API-key compatibility and read-only behavior.
- Added rendered public-page audit and sitemap inventory/batch audit.
- Expanded probes to safe public frontend routes while keeping WordPress administration, REST, login and executable paths blocked.
- Added DOM-independent parsing fallback and preserved the read-only/privacy-safe contract.
- Fixed KOZ Suite submenu registration so the existing Site Bridge admin URL remains accessible when another KOZ plugin owns the suite menu.
- Removed a duplicate Site Bridge catalog entry.
- WordPress.org strict prefix re-audit with canonical
kozbridge / KOZBRIDGEidentifiers. - Existing API-key options migrate automatically without deleting historical values.
- Added canonical
/wp-json/kozbridge/v1routes while preserving both earlier REST namespaces. - Plugin-specific runtime, suite fallback, admin assets and support identifiers.
- Rebranded as KOZ Site Bridge.
- Added KOZ Suite integration and multilingual administration.
- Added canonical KOZ REST namespace and X-KOZ-Key authentication.
- Preserved legacy API keys, endpoint and header compatibility.
- Replaced site-specific probe paths with a generic safe allowlist.
- Added a dedicated enqueued admin interface and shared KOZ support panel.