Siteward Child
| 开发者 | omniswp |
|---|---|
| 更新时间 | 2026年9月15日 03:51 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Siteward Child is the companion plugin for Siteward, a free, self-hosted dashboard for managing many WordPress sites from one place. Install this plugin on any WordPress site you want to manage centrally, then connect it to your dashboard with a one-time secure handshake.
Once connected, it exposes a single signed REST endpoint that your dashboard uses to read update status, UpdraftPlus backup history and site health, apply updates, and manage plugins. The dashboard always initiates the traffic. This plugin never calls out on its own.
- Signed, replay-protected REST endpoint (verified against your dashboard's public key).
- Reports core, plugin and theme updates.
- Reports UpdraftPlus backup history and status.
- Reports basic site health (WP-Cron, load).
- Applies updates and, for fleet plugin management, activates, deactivates or uninstalls plugins, but only when instructed by your signed, paired dashboard.
安装:
- Upload the
siteward-childfolder to/wp-content/plugins/, or install it from the Plugins screen. - Activate the plugin through the Plugins screen.
- Go to Settings → Siteward Connection, copy the site's REST URL and its one-time connection key, and paste them into your Siteward dashboard's Add Site screen.
常见问题:
Does this plugin do anything by itself?
No. It only responds to a paired Siteward after a secure handshake.
Is the connection secure?
Yes. Every request is verified against the dashboard's stored public key, with timestamp and nonce replay protection.
Why does the dashboard ask this site to check for updates?
Premium plugins only report an update when their licence is active at the moment WordPress checks, and that check is cached for hours. When you press "Check for updates" on the dashboard, this plugin asks every licence server again straight away, so a licence you have just renewed is picked up without waiting for the cache to expire.
How do I disconnect?
Disconnect the site from the dashboard, or deactivate this plugin. The stored public key is removed on disconnect.
Can the dashboard manage plugins on my site?
Yes, once paired, your Siteward dashboard can activate, deactivate or permanently uninstall plugins on this site, but only over the cryptographically-signed connection (every request is verified against the stored dashboard public key, with timestamp and nonce replay protection). This plugin does not install new plugins from uploaded packages; uninstalls permanently delete an existing plugin's files. This plugin never initiates any outbound connection on its own.
更新日志:
0.7.10
- Fix: "Sync now" could time out on sites behind a CDN or reverse proxy such as Cloudflare. The health check ran WordPress's REST API availability test, which calls the site back through its own public address and can hang for 10 seconds when the server cannot reach itself that way. That test is now skipped, as WordPress itself does for scheduled checks, which also removes a false "REST API encountered an unexpected result" warning it reported on every site.
- New: theme update checks now run in the same simulated admin context that plugin checks already used, so a licensed theme such as Divi can report its update to the dashboard instead of only showing it to someone who happens to open the site's own admin.
- Fix: "Check for updates" was deleting the pending update for licensed themes such as Divi instead of finding it. The check clears the theme update list before rebuilding it, and a background request can only rebuild the WordPress.org part, so the one button you would press when a theme update is missing was the thing removing it.
- Fix: activating, deactivating, uninstalling or updating any plugin no longer discards the pending updates for every other plugin on the site. WordPress clears its whole update list whenever the plugin list changes, which for plugins sold with a licence means an update that cannot be found again from a background check. Updating one plugin could quietly hide a real update for another.
- Fix: theme updates now get the same protection as plugin updates. A licensed theme's update was being discarded by the routine check in exactly the same way.
- Fix: updates for licensed plugins such as Perfmatters and ACF Pro no longer disappear from the dashboard. Plugins sold with a licence register their update checker only during an admin request, so the routine check, which runs over the REST endpoint, rebuilt the list from WordPress.org alone and deleted the entry the site had already learned about. An update could show on the dashboard, install correctly, and then vanish for no visible reason. A pending update is now kept unless the plugin has been removed or the version on disk shows it was actually applied.
- New: answers a "check for updates" request from the dashboard by asking every licence server again, ignoring the usual throttle. Premium plugins whose licence was just renewed can otherwise keep reporting no update until their cached answer expires.
- New: reports the installed theme list to the dashboard, so theme vulnerabilities can be matched as well as plugin ones. Read-only, like the rest of the reporting.
- Reports this site's server IP address to its paired dashboard, so the dashboard can group sites that share a server. Nothing is sent anywhere else; the dashboard still initiates every request.
- Critical fix: 0.7.1 could stop itself on load, leaving the site with no connection to its dashboard, no settings page, and a notice that could not be dismissed. This affected normal single installs, not only sites with two editions. Updating to 0.7.2 restores the connection and the settings page automatically; no action is needed on your part.
- Fix: deleting this plugin no longer removes the stored connection when another edition of Siteward Child is still active on the site and using it. Previously that silently unpaired the site from its dashboard.
- Housekeeping: uninstall now also removes the update-snapshot option it creates.
- The plugin inventory response now reports which edition is installed, so a dashboard sees a switch between editions straight away instead of at the next scheduled sync.
- Removed installing plugins from a dashboard-uploaded package, for WordPress.org guideline compliance. This plugin now only updates, activates, deactivates and uninstalls existing plugins. Dashboard-driven installation of new plugins is available in the separately-distributed Siteward Advanced Child.
- Housekeeping: internal option and transient names now share the plugin's prefix.
- Housekeeping: the direct filesystem method is now forced only during install and uninstall (the actions that write to disk), not on read-only actions like inventory, activate or deactivate.
- Removed the install-from-URL option for WordPress.org guideline compliance. Plugins are now installed only from a ZIP package your dashboard uploads. Updating, activating, deactivating and uninstalling are unchanged.
- Premium/licensed plugin updates (for example Perfmatters or ACF Pro) now show as available on every managed site, not only ones an administrator has recently opened. The status sync and fleet inventory run the same admin-context update check as the apply path, throttled so routine syncs do not hammer licence servers.
- Fix: updating a premium/licensed plugin (for example Perfmatters or ACF Pro) from the dashboard could report "the plugin is at the latest version" and skip the update. Such plugins only publish their update during an admin-context check; the child now forces a genuine, throttle-bypassing update check so the licensed updater runs and the update installs.
- Fleet plugin management: signed actions to inventory, activate, deactivate, uninstall and install (from an uploaded ZIP) plugins from the dashboard. Every slug is traversal-guarded.
- Hardening: constrain update/reactivate targets to installed plugins/themes (validate_file + membership checks); restrict the auto-login redirect to a known allow-list of admin screens.
- Update reliability: keep active plugins active through updates (define DOING_CRON so core never deactivates mid-update), snapshot/restore the active set with a shutdown reconciler, and dependency-order reactivation so WooCommerce and its extensions come back together.
- Fix: plugins could be left deactivated after an update in unattended runs.
- Public release.