Siteward Child
| 开发者 | omniswp |
|---|---|
| 更新时间 | 2026年7月30日 06:48 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Siteward Child is the companion plugin for Siteward. Install it on any WordPress site you want to manage centrally, then connect it to your dashboard with a one-time secure handshake.
Once connected, it exposes a single signed REST endpoint that your dashboard uses to read update status, UpdraftPlus backup history and site health, apply updates, and manage plugins. The dashboard always initiates the traffic. This plugin never calls out on its own.
- Signed, replay-protected REST endpoint (verified against your dashboard's public key).
- Reports core, plugin and theme updates.
- Reports UpdraftPlus backup history and status.
- Reports basic site health (WP-Cron, load).
- Applies updates and, for fleet plugin management, activates, deactivates or uninstalls plugins, but only when instructed by your signed, paired dashboard.
安装:
- Upload the
siteward-childfolder to/wp-content/plugins/, or install it from the Plugins screen. - Activate the plugin through the Plugins screen.
- Go to Settings → Siteward Connection, copy the site's REST URL and its one-time connection key, and paste them into your Siteward dashboard's Add Site screen.
常见问题:
Does this plugin do anything by itself?
No. It only responds to a paired Siteward after a secure handshake.
Is the connection secure?
Yes. Every request is verified against the dashboard's stored public key, with timestamp and nonce replay protection.
How do I disconnect?
Disconnect the site from the dashboard, or deactivate this plugin. The stored public key is removed on disconnect.
Can the dashboard manage plugins on my site?
Yes, once paired, your Siteward dashboard can activate, deactivate or permanently uninstall plugins on this site, but only over the cryptographically-signed connection (every request is verified against the stored dashboard public key, with timestamp and nonce replay protection). This plugin does not install new plugins from uploaded packages; uninstalls permanently delete an existing plugin's files. This plugin never initiates any outbound connection on its own.
更新日志:
0.7.3
- Reports this site's server IP address to its paired dashboard, so the dashboard can group sites that share a server. Nothing is sent anywhere else; the dashboard still initiates every request.
- Critical fix: 0.7.1 could stop itself on load, leaving the site with no connection to its dashboard, no settings page, and a notice that could not be dismissed. This affected normal single installs, not only sites with two editions. Updating to 0.7.2 restores the connection and the settings page automatically; no action is needed on your part.
- Fix: deleting this plugin no longer removes the stored connection when another edition of Siteward Child is still active on the site and using it. Previously that silently unpaired the site from its dashboard.
- Housekeeping: uninstall now also removes the update-snapshot option it creates.
- The plugin inventory response now reports which edition is installed, so a dashboard sees a switch between editions straight away instead of at the next scheduled sync.
- Removed installing plugins from a dashboard-uploaded package, for WordPress.org guideline compliance. This plugin now only updates, activates, deactivates and uninstalls existing plugins. Dashboard-driven installation of new plugins is available in the separately-distributed Siteward Advanced Child.
- Housekeeping: internal option and transient names now share the plugin's prefix.
- Housekeeping: the direct filesystem method is now forced only during install and uninstall (the actions that write to disk), not on read-only actions like inventory, activate or deactivate.
- Removed the install-from-URL option for WordPress.org guideline compliance. Plugins are now installed only from a ZIP package your dashboard uploads. Updating, activating, deactivating and uninstalling are unchanged.
- Premium/licensed plugin updates (for example Perfmatters or ACF Pro) now show as available on every managed site, not only ones an administrator has recently opened. The status sync and fleet inventory run the same admin-context update check as the apply path, throttled so routine syncs do not hammer licence servers.
- Fix: updating a premium/licensed plugin (for example Perfmatters or ACF Pro) from the dashboard could report "the plugin is at the latest version" and skip the update. Such plugins only publish their update during an admin-context check; the child now forces a genuine, throttle-bypassing update check so the licensed updater runs and the update installs.
- Fleet plugin management: signed actions to inventory, activate, deactivate, uninstall and install (from an uploaded ZIP) plugins from the dashboard. Every slug is traversal-guarded.
- Hardening: constrain update/reactivate targets to installed plugins/themes (validate_file + membership checks); restrict the auto-login redirect to a known allow-list of admin screens.
- Update reliability: keep active plugins active through updates (define DOING_CRON so core never deactivates mid-update), snapshot/restore the active set with a shutdown reconciler, and dependency-order reactivation so WooCommerce and its extensions come back together.
- Fix: plugins could be left deactivated after an update in unattended runs.
- Public release.