SteadWeave Companion

Free Forever: 1 website, complete monitoring SteadWeave Free includes complete monitoring for one website, free forever. There is no trial period and no expiration. SteadWeave Companion is the complete WordPress plugin, not a separate “Lite” or feature-locked edition. Paid plans are available when you need to monitor more websites. SteadWeave Companion is the lightweight WordPress-side connector for the SteadWeave external monitoring service. The Companion does not perform the central monitoring workload locally. After a WordPress administrator explicitly starts setup and confirms the external-service disclosure, the plugin connects the site to SteadWeave. After pairing, authenticated technical heartbeats let the service evaluate WordPress health, software versions, update availability and other website-assurance signals. The PHP, JavaScript, CSS, translations, documentation and bundled image assets distributed in this WordPress.org plugin package are licensed under GPLv2 or later. The SteadWeave name and source-identifying marks may also be protected by applicable trademark law; those trademark rights are separate from, and do not restrict, the GPL license granted for the copies of the bundled assets distributed with this plugin. See ASSET-LICENSE.txt and LICENSE.txt. SteadWeave is a separate SaaS service. Service plans may differ by the number of websites that can be managed. The Companion does not hide premium PHP code or unlock local plugin functionality with a license key. What the Companion does

• Provides a request-first secure pairing flow.
• Creates a cryptographic installation identity used to verify control of the WordPress installation.
• Stores issued access credentials locally using authenticated encryption when supported by the server.
• Sends authenticated technical heartbeats only after pairing.
• Advertises locally available Smart Fix capabilities to the paired service.
• Receives bounded, authenticated Smart Fix commands only after pairing and only after an authorized SteadWeave account user explicitly requests Assisted Remediation.
• Can update supported SEO metadata through Yoast SEO, Rank Math, AIOSEO or SEOPress when one supported provider is detected unambiguously.
• Can replace exact verified HTTP hyperlink references in published WordPress post content without requiring an SEO plugin.
• Verifies Smart Fix targets and current values, reports structured results, and supports bounded preflight and rollback safeguards.
• Reports WordPress/PHP versions, plugin/theme inventory and update state, site URLs, limited server context and WordPress cron state used by the monitoring service.
• Receives SteadWeave branding and the customer dashboard URL as part of authenticated service responses.
• Provides connection diagnostics and an administrator-only recovery path.
• Stops scheduled authenticated telemetry when pairing is reset or the plugin is deactivated.
• Integrates with WordPress privacy-policy, personal-data export and personal-data erasure tools for the locally stored enrollment email.

The plugin does not add analytics, advertising trackers, marketing pixels or public-site credits. The Companion does not download or execute arbitrary PHP or JavaScript from SteadWeave, does not install plugins or themes remotely, and does not expose a general-purpose remote code execution mechanism. Security hardening SteadWeave Companion includes application-layer security controls for its own REST and administration surface:

• a WAF-like REST pre-filter for malformed requests, oversized payloads, scanner user agents and high-confidence SQLi/XSS/path-traversal/XXE patterns;
• strict machine-secret validation plus authenticated encryption at rest (libsodium secretbox, or AES-256-GCM fallback) for recoverable access/enrollment credentials;
• token-bucket rate limiting per endpoint/IP and per installation or enrollment-credential identity, plus progressive HMAC-authentication lockout;
• standard rate-limit response metadata (X-RateLimit-* and Retry-After on 429 responses);
• a structured local JSON security event log with configurable retention, secret redaction and an HMAC-SHA-256 tamper-evident hash chain;
• administrator-only security configuration and filtered CSV/JSON log export under SteadWeave → Security;
• a nonce-based Content Security Policy for Companion administration pages, with Report-only mode enabled by default for safe rollout;
• optional site-wide XML-RPC hardening when XML-RPC is not required by another integration.

The Companion does not generate public-site HTML views, so its CSP applies to its WordPress administration pages. A network-edge WAF/DDoS service, reverse-proxy/site-wide CSP, TLS/server hardening, database ACLs and off-host SIEM/log retention remain infrastructure responsibilities. Detailed configuration and test guidance is included in docs/security-en_US.md and docs/security-it_IT.md.

1. Install and activate SteadWeave Companion.
2. Open SteadWeave in the WordPress administration menu.
3. Review the external-service disclosure and linked Privacy Notice and Terms of Service.
4. Enter the email address to use for setup notifications.
5. Explicitly confirm the external-service connection.
6. Select Start secure setup.
7. Complete the guided setup on app.steadweave.com.
8. Return to WordPress and verify that the connection status becomes Connected.

No SteadWeave password, API token or secret credential needs to be copied by email during the normal pairing flow.

1.0.10

• Add a Companion-scoped WAF-like REST pre-filter for malformed/oversized requests, scanner user agents and high-confidence SQLi, XSS, path-traversal and XXE signatures.
• Strengthen access/enrollment machine-secret validation while preserving authenticated encrypted storage and wire compatibility with the SteadWeave service.
• Replace the original enrollment limiter with expiring token buckets per endpoint/IP and per installation or enrollment credential, standard X-RateLimit-* headers, HTTP 429 Retry-After, and progressive HMAC lockout.
• Add structured JSON security logging with UTC timestamp, user ID, source IP, action, outcome, redacted context, configurable retention and HMAC tamper-evident chaining.
• Add SteadWeave → Security for status, WAF/XML-RPC controls, rate-limit/lockout thresholds, retention, CSP mode, filtered log viewing, CSV/JSON export and hash-chain verification.
• Add Companion-admin CSP with per-request nonces and Report-only default; document the remaining edge WAF/DDoS, server, database and off-host logging responsibilities.
• Update English/Italian security documentation, privacy disclosure and translation catalogs. No Companion REST route, payload or service-signature breaking changes.

1.0.9

• Preserve the real upstream HTTP status when a successful SteadWeave response is later rejected by local pairing-response validation.
• Add safe enrollment diagnostics that identify the response-validation phase and a non-secret reason code, including central URL mismatches, without exposing credentials or pairing tokens.
• Clear the new diagnostic metadata on successful communication, pairing reset and uninstall while keeping production central-server pinning unchanged.

1.0.8

• Fix approved-but-unpaired enrollment recovery: Refresh setup status can securely request fresh pairing credentials when central delivery was not confirmed, verify them before local storage, and finish the authenticated connection without manual credential entry.
• Keep the 1.0.7 WordPress.org Free Forever messaging, screenshots, Smart Fix retention disclosure, response-size hardening and reset cleanup unchanged.
• Make the Companion UI distinguish approval from an actually completed pairing, so an APPROVED request is no longer shown as Awaiting approval or told to repeat the central onboarding wizard.

1.0.7

• Make the Free Forever offer prominent in the WordPress.org listing: complete SteadWeave monitoring for one website, with no trial period or expiration.
• Clarify that SteadWeave Companion is the complete plugin, not a separate Lite or feature-locked edition.
• Refresh the WordPress.org banner message to highlight the one-site Free Forever offer.
• No functional behavior changes from 1.0.6.

1.0.6

• Add official WordPress.org screenshots and listing captions for the secure setup and Assurance dashboard flows.
• Refresh public release metadata for the WordPress.org 1.0.6 tag.
• No functional behavior changes from 1.0.5.

1.0.5

• Fix the WordPress admin menu icon regression by using a dedicated 20x20-pixel bundled icon instead of the full-size branding artwork.
• Separate the admin-menu icon accessor from the dashboard/favicon branding icon so future branding changes cannot alter the menu icon dimensions.
• Synchronize the Italian translation catalog with the final 1.0.5 source strings and translator context.
• Clear the local Smart Fix anti-replay ledger and remediation diagnostics when pairing is reset, and document its bounded seven-day retention.
• Verify secure enrollment-secret persistence before using newly generated enrollment material.
• Bound SteadWeave HTTP response sizes and make loopback-host handling consistent across enrollment, heartbeat, remediation reporting and branding validation.

1.0.4

• Add the required translator context for the external-service URL placeholders in the WordPress privacy-policy text.

1.0.3

• Removed pre-public-release storage, cryptography and REST compatibility shims so the WordPress.org package uses only the canonical SteadWeave Companion identifiers and REST namespace.
• Clarified that all bundled plugin assets, including the shipped logo and icon copies, are GPLv2 or later while trademark rights remain separate.
• Scoped Companion branding, palette styling and favicon changes to the SteadWeave admin screen; the WordPress admin menu uses the bundled local icon.
• Removed synchronous branding HTTP requests from WordPress administration requests. Branding is synchronized only through authenticated service responses such as enrollment and heartbeat traffic.
• Moved enrollment-completion payload-size and HMAC authentication checks into the REST permission_callback before the write callback executes.
• Expanded the external-service and WordPress privacy disclosures to document all supported Smart Fix operations and remediation-result data.
• Clarified that Smart Fix does not download arbitrary executable code, install extensions or provide a general-purpose remote code execution mechanism.
• Removed per-request cron schedule repair from init; schedules are managed at activation, successful pairing, reset and deactivation boundaries.
• Reformatted review-sensitive PHP for human readability and cleaned the public changelog to published 1.x releases only.

1.0.2

• Updated the WordPress.org Tested up to declaration to WordPress 7.1.
• Prefixed the uninstall loop variable to satisfy WordPress global naming conventions.
• Replaced the dynamic filter-name invocation in product URL resolution with explicit prefixed filter hooks.

1.0.1

• Aligned the gettext text domain with the steadweave-companion WordPress.org slug.
• Replaced short global identifiers with collision-safe SteadWeave Companion namespaces, constants, options and hooks.
• Replaced directly emitted admin CSS with WordPress enqueue APIs and context-appropriate output escaping.

1.0.0

• Initial public SteadWeave Companion release.