WordSocket
| 开发者 | wpsignal |
|---|---|
| 更新时间 | 2026年4月13日 11:41 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
WordSocket sends realtime events from your WordPress site to connected browsers.
When content changes: a post is published, a comment is approved, an option is updated: the plugin pushes the event to subscribers instantly via WebSocket (with SSE fallback).
On WordPress 7.0+, WordSocket also registers as a WebSocket-based Yjs sync provider for real-time collaborative editing in the block editor, replacing the default HTTP polling transport with a low-latency WebSocket connection.
WPSignal is an independent service and is not affiliated with or endorsed by the WordPress project.
Features:
- One-click automatic connection via the WPSignal dashboard (no API key required)
- Manual connection via API key for advanced setups
- Disconnect button with inline confirmation, removes the site from the server immediately
- WebSocket-first with automatic SSE fallback
- Per-site JWT signing secrets: each site's connection tokens are cryptographically isolated
- AES-256-GCM encrypted event payloads: the WPSignal relay receives ciphertext only and never has access to plaintext message content
- Real-time collaborative editing in the block editor (WordPress 7.0+, via Yjs sync provider)
- Admin toggle to disable the collaboration provider and fall back to WordPress HTTP polling
- Built-in triggers for post updates and custom post types
- Custom trigger builder: map any WordPress action hook to a realtime event
- Public JavaScript API (
window.WPS) for themes and plugins to share the connection - Extensible connection token:
wpsignal_token_channelsandwpsignal_token_channel_prefixesfilters let other plugins add channels and namespace permissions to the JWT without modifying core - Admin explorer page with live event log, publish form, and token inspector
- Short-lived JWTs (5 min) with automatic refresh
- Install the plugin and connect to the WPSignal service.
- When content changes in WordPress, the plugin encrypts and publishes an HMAC-signed event to the WPSignal server.
- The server pushes the ciphertext to all browsers subscribed to that channel.
- The browser decrypts the payload and dispatches
wpsignal:*DOM events. The relay never sees plaintext content. - On WordPress 7.0+, the block editor uses the same WebSocket connection for collaborative editing with no extra configuration.
- Site registration: when you connect in the admin (via the automatic one-click flow or by entering an API key manually), the plugin registers your site with the server and receives credentials.
- Event publishing: when a trigger fires (e.g. a post is saved), the plugin sends an encrypted, HMAC-signed HTTP request to the server.
- Realtime connections: logged-in users' browsers connect to the server via WebSocket or SSE to receive events.
- Collaborative editing: on WordPress 7.0+, Yjs document updates are relayed over the same WebSocket connection.
安装:
- Upload the
wordsocketfolder to/wp-content/plugins/, or install directly from the WordPress plugin directory. - Activate the plugin through the "Plugins" menu in WordPress.
- Go to WordSocket > Settings > Connection.
- Choose a connection method:
- Automatic (recommended): Click Connect with WPSignal. You will be redirected to the WPSignal dashboard to authorize the connection. No API key entry required.
- Manual: Switch to the Manual tab, paste your API key, and click Save Settings.
- The plugin registers with the server and saves credentials automatically.
屏幕截图:
常见问题:
What is WPSignal?
WPSignal is a realtime event delivery service for WordPress. It pushes events from your site to connected browsers the moment they happen, without polling.
Do I need a wpsignal.io account?
Yes. The plugin requires a WPSignal account to relay events. Create a free account at wpsignal.io.
What data is sent to the WPSignal server?
During registration: your site URL and name. During normal operation: AES-256-GCM encrypted event payloads (the server never sees plaintext content). On WordPress 7.0+, Yjs document updates (binary diffs of block editor content) are also relayed. All data is delivered in realtime and is not stored on the server. See our Privacy Policy for full details.
Are my event payloads private?
Event payloads are encrypted with AES-256-GCM before leaving WordPress. The encryption key is derived from your WordPress salts and site key using HKDF-SHA256, and is never sent to the WPSignal server. This means the relay cannot read your message content. Note: all logged-in users on the same site share the same derived key. Per-user message privacy is out of scope for the current version.
Does this work for logged-out visitors?
The built-in client script loads for logged-in users by default. You can enqueue the script for all visitors by adding wpsignal as a dependency to your own script.
What happens if WebSocket is unavailable?
The client falls back to SSE for receiving events. window.WPS.subscribe() and window.WPS.unsubscribe() work on SSE connections: channel changes are tracked and applied immediately via a lightweight SSE reconnect (50 ms debounce). For collaborative editing, the plugin detects the fallback and emits a "not synced" status so WordPress can surface the appropriate indicator. You can also disable the collaboration provider entirely from WordSocket > Settings > Connection to restore WordPress HTTP polling for all editors.
Does collaborative editing require WordPress 7.0?
Yes. The Yjs sync provider integration requires WordPress 7.0 or later. The plugin detects the WordPress version and only registers the provider when @wordpress/sync is available.
更新日志:
0.14.0
- Revamp admin ui, moved explorer to settings app
- remove self-hosted text
- Updated screenshots
- Exclude BETA.md from plugin build
- feat: skeleton preloader for app.feat: disable automatic authentication for non-ssl.fix: disable encryption when on non-ssl.
- Fix: non-ssl default to manual authentication
- Improved: Connections UI. Reduced connections from 2 to 1 on connections page.
- Fix: option key change for RTC enabled.
- New: Automatic connection flow. Admins can connect via the WPSignal dashboard with a single click, without entering an API key. Uses a CSRF-protected OAuth-style code exchange.
- New: Disconnect button in the Connection tab. Removes the site from the WPSignal server and clears all local credentials, with inline confirmation before proceeding.
- New: Per-site JWT signing secrets. Each site's connection tokens are now signed with a unique secret, isolating sites cryptographically and eliminating cross-site token forgery risk.
- Improved: Connection tab redesigned with Automatic and Manual sub-tabs to clearly separate the two connection methods.
- Improved: Disconnect works correctly regardless of how the site was connected: API key authentication for manual connections, publish-secret authentication for automatic connections.
- New: Plugin renamed to "WordSocket" to comply with WordPress.org plugin directory guidelines.
- Improved: Settings Connection tab revamped: server URL field removed, flow simplified to API Key entry and a single Connect action.
- Improved: API key validated client-side before attempting connection.
- Improved: Connection tab now surfaces WordPress real-time collaboration (RTC) availability and WP version compatibility, with clearer, more descriptive warnings when collaborative editing is unavailable.
- Improved: PHP documentation blocks updated across all core classes for better tooling and doc parser support.
- Developer:
.potlanguage file added (eventra-for-wpsignal.pot).
- Fixed: WordPress 7.0 Beta 2 compatibility for the Yjs sync provider. Collection-level providers (e.g. collaborative notes) receive a null
objectId; the provider now maps this to a shared"collection"channel suffix so all peers join the same channel. - Fixed:
ProviderCreatorOptionstype updated to acceptobjectId: string | number | null, matching the Beta 2 provider creator API.
- New:
wpsignal_token_channelsfilter: plugins can append channels to the initial auto-subscribe list in the minted JWT. - New:
wpsignal_token_channel_prefixesfilter: plugins can add channel-prefix permissions to the JWTallowed_channel_prefixesclaim, enabling server-enforced access to custom channel namespaces. - Improved:
window.WPS.subscribe()andwindow.WPS.unsubscribe()now work on SSE connections. Channel changes are tracked in a persistent set and applied immediately via a debounced SSE reconnect, so plugins that call these methods do not need to know the current transport. - Developer:
forceSSEconfig flag available for testing the SSE transport without browser tooling.
- New: AES-256-GCM encrypted event payloads. The WPSignal relay receives and forwards ciphertext only: plaintext message content never leaves WordPress.
- New: Encryption key derived from WordPress salts and site key via HKDF-SHA256. Key is never transmitted to the WPSignal server.
- New:
wpsignal_encryption_seedfilter for plugins and themes to supply custom key material. - New:
SubtleCryptodecryption in the browser client: events are dispatched only after successful decryption.
- New: Real-time collaborative editing in the block editor (WordPress 7.0+) via Yjs WebSocket sync provider.
- New:
publishBinary()andonBinaryMessage()methods onwindow.WPSfor binary WebSocket frames. - New:
transportproperty onwindow.WPSexposes the current connection type ('ws','sse', ornull). - New: Admin toggle in Settings to enable or disable the real-time collaboration provider independently.
- Improved: Collaboration provider emits
disconnectedstatus when WebSocket is unavailable, allowing WordPress to show its "not synced" indicator.
- New: Custom trigger builder: register triggers from the admin UI without code.
- New: Settings page rebuilt as a React app with Connection and Triggers tabs.
- New: Explorer (Kitchen Sink) admin page with 5 interactive panels.
- New: Public JavaScript API (
window.WPS): subscribe, publish, event listeners. - New:
WPS::trigger()fluent builder andWPS::publish()facade methods. - New: Support for self-hosted servers (configurable server URL).
- Improved: OOP architecture with PSR-4 autoloading under the
WPSignalnamespace. - Improved: TypeScript source with
@wordpress/scriptsbuild pipeline.
- Initial release.