NoyaCare
| 开发者 | noyanahmed |
|---|---|
| 更新时间 | 2026年11月2日 01:09 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Restore point — the plugin or theme folder is archived and the option rows it owns are saved.
- Update — the item is installed on its own, never in a batch, so a failure always has a clear cause.
- Check — key pages are loaded over real HTTP and compared with before the run: status codes, PHP fatal errors on those pages or in the updated code, a page that shrinks or stops half-way, and new PHP error-log entries.
- Roll back — if the site broke, the restore point is put back automatically and the run carries on (or stops, your choice).
- Report — the client gets an HTML e-mail, with a PDF when the backup folder is protected. Every run and every item has its own reference number.
- A restore point before every item, small and fast even on shared hosting: one folder and its option rows. A full database dump is optional.
- The live site is checked over HTTP, the way a visitor sees it — not from inside the update process.
- Careful rollback rules. Only a problem a visitor would notice counts as a failure. Slowdowns and deprecation notices are reported, never rolled back.
- Background runs that survive shared hosting: small steps, a watchdog, a live progress bar and a cancel button.
- Quarantine. A version that broke the site stays held until you release it.
- Security fixes first. With a WPScan or Patchstack key, an update that fixes a known vulnerability goes in straight away and leads the client report.
- Website speed from Google PageSpeed Insights and NoyaCare's own checks, which also work on local sites, kept as a trend.
- No bloat. No bundled libraries and no build step.
0 3 * * 2 cd /path/to/site && wp noyacare run --quiet
or keep NoyaCare's schedule and call WP-Cron every few minutes:
*/5 * * * * cd /path/to/site && wp cron event run --due-now --quiet
WP-CLI
wp noyacare status|run|health|speed|quarantine|backups|restore|prune|access|report — wp help noyacare <command> shows the options of each, such as run --dry-run.
REST API
Read-only, authenticated with an application password over HTTPS: GET /wp-json/noyacare/v1/status, …/updates, …/runs/<run-uid>, …/performance. No run starts from outside.
For developers
Filters and actions include noyacare_loaded, noyacare_run_tasks, noyacare_report_data, noyacare_capability and noyacare_run_finished. Like WordPress's own, NoyaCare's requests to the site skip TLS certificate checks, which local and staging sites would fail; noyacare_sslverify turns them on.
安装:
- Install and activate NoyaCare from Plugins → Add New.
- In NoyaCare → Settings, choose the schedule, the pages to check and the report recipients, then send a test report.
- Open NoyaCare → Restore points. If the backup folder is open to the web (common on Nginx), follow the steps shown there.
FS_METHOD and the FTP_* constants in wp-config.php: an unattended run cannot answer a credentials prompt.屏幕截图:
常见问题:
What happens if a run dies half way through?
A watchdog resumes a background run within about five minutes; the item being updated is put back to its restore point and the run carries on. A run with no progress for 30 minutes is stopped cleanly: the maintenance page comes down and the report still goes out.
Why is an update held?
"Held — version X broke this site": that version was rolled back before, so it is quarantined. Release it from the dashboard or with wp noyacare quarantine release <slug>; the next run tries it again. Newer versions are not affected.
"Needs PHP 8.2 or newer": the new version needs a newer PHP or WordPress (WordPress itself: PHP or MySQL) than this site has, so WordPress would not install it either. WP-CLI and system cron go by their own PHP when it is older. It stays held, even with "install everything", until the server or WordPress is updated.
"Held until the backup folder is closed": only where restore points cannot be encrypted (no OpenSSL or sodium, or no temporary folder outside the site) and files in the backup folder can be downloaded from the web. Restore points shows how to close it, with a message to copy for your host.
Where are restore points stored?
In a randomly named folder inside wp-content/uploads/noyacare-backups/, closed by .htaccess (Apache, LiteSpeed) and web.config (IIS). A daily test asks the web server for harmless test files there; Restore points shows the result. Nginx ignores .htaccess: add this to the server block:
location ^~ /wp-content/uploads/noyacare-backups/ { deny all; }
Restore points are encrypted with a key kept in the site's database, never in the folder, so where it is open updates still go ahead. Full database backups and reports are kept only in a folder found closed (a redirect or an unclear answer does not count), restores by hand wait for it, and a folder found open loses its database backups and reports at once.
Where PHP runs as the account owning the site's files (most shared hosting), only that account can read these files (0600, in 0700 folders); filter noyacare_private_modes.
Does a rollback undo my orders or posts?
No. It puts back the item's files and the option rows that changed since the restore point (a restore by hand: only the item's own). Its database tables (a WooCommerce database update, say), orders, posts and other plugins' settings stay as they are, so hold major versions of plugins that migrate data. NoyaCare never imports a full database backup.
Can I keep other administrators out of NoyaCare?
Yes, under Settings → Access. You stay on the list; changes are logged and e-mailed to the managers. Locked out? Run wp noyacare access reset. Any administrator can still deactivate plugins.
Who can run updates?
In the admin: administrators who manage NoyaCare and may update plugins, themes and WordPress. Where updates run, only they change the schedule, the update policy and the restore point and check settings, and a run installs only what its starter may update. WP-CLI has no WordPress user: whoever can run it on the server can start a run or a restore. A schedule runs once such an administrator has switched it on. Nothing is installed where DISALLOW_FILE_MODS is set; on multisite, updates run from the main site.
What if the salts change?
API keys are encrypted with a key made from AUTH_KEY and SECURE_AUTH_SALT, or NOYACARE_ENCRYPTION_KEY. After new salts, enter the keys again. Restore points have a key of their own, which new salts do not change; restoring an older database without it makes newer restore points unreadable.
Can I manage several sites from one dashboard?
No. Nothing outside a site can update it or start a run there. The read-only REST API lets a dashboard of your own show how sites are doing.
更新日志:
- Changed: each PageSpeed Insights score is the middle of three tests, 45 seconds apart, as Google advises; a repeat from Google's cache is not counted.
- Changed: Google is asked for the same categories as the PageSpeed Insights website asks for.
- New: real visitors' speed (Google's Chrome data, 28 days) in words, for reports.
Older versions are listed in
changelog.txt.