WordSocket

WPSignal is a realtime event delivery service for WordPress. It pushes events from your site to connected browsers the moment they happen, without polling.

Yes. The plugin requires a WPSignal account to relay events. Create a free account at wpsignal.io.

During registration: your site URL and name. During normal operation: event payloads, AES-256-GCM encrypted on every site including plain HTTP ones, with a key derived from your site's WordPress salts that the server never receives, so it never sees their contents. Channel names stay readable because the server routes on them. When real-time collaboration is enabled, Yjs document updates (binary diffs of block editor content) are also relayed. These are not encrypted, so the server could read them; it forwards them by channel and never parses or stores them. All data is delivered in realtime and is not stored on the server. See our Privacy Policy for full details.

Event payloads are encrypted with AES-256-GCM before leaving WordPress. The encryption key is derived from your WordPress salts and site key using HKDF-SHA256, and is never sent to the WPSignal server. This means the relay cannot read your message content. Note: all logged-in users on the same site share the same derived key. Per-user message privacy is out of scope for the current version.

Real-time collaboration was removed from WordPress core before the 7.0 release and currently ships with the Gutenberg plugin as an experiment. Install and activate Gutenberg, then turn on Gutenberg > Experiments > "Enable real-time collaboration". The WordSocket Settings tab shows a "Gutenberg detected" badge when the feature is available, and the sync provider activates automatically once collaboration is enabled. Post types without custom-fields support are excluded by Gutenberg itself.

The built-in client script and the token endpoint (/wp-json/wpsignal/v1/token) are limited to logged-in users by default. To open them to all visitors, return true from the wpsignal_allow_client filter: add_filter( 'wpsignal_allow_client', '__return_true' ); Tokens minted for visitors carry user ID 0 and are scoped to your site, so keep in mind that anyone can then subscribe to your site's public channels and publish over the WebSocket.

The plugin tells the WPSignal server to archive the site, then deletes the stored credentials (site key, secrets, and the API key if you connected manually). Your usage history stays on the server, and connecting the same site URL again restores the site with fresh secrets. On a manual connection you will need to paste the API key again. If the server cannot be reached, nothing is deleted and you can retry.

The WPSignal dashboard refuses to authorize a site when your plan's site limit is reached (the message names the site to disconnect first), when your account email is not yet verified, or when the account has been deactivated. The Connect tab shows the exact reason returned by the server.

An extension is a separate plugin built on WordSocket (WooCommerce, Live Blog, and Chat are on the way). Its settings appear on the WordSocket settings page under the Extensions tab, which also lists what is available. Developers: register on wpsignal_loaded with WPS::instance()->extensions()->register(), enqueue a settings script on the wordsocket_settings_enqueue action with wpsignal-settings as a dependency, and render window.wordsocket.ExtensionPanel from a plugin registered with wp.plugins.registerPlugin( slug, { scope: 'wordsocket', render } ). An extension with settings of its own adds a tab to this page with window.wordsocket.registerTab( { name, title, render } ) (0.28).

Yes. Reserve a namespace on wpsignal_loaded: WPS::instance()->channels()->reserve( 'orders', 'manage_woocommerce' ) (a capability, or a callable receiving the user ID). The relay then refuses subscribe and publish frames on that namespace from anyone else. Once any namespace is reserved, tokens list channels explicitly instead of allowing every channel of the site, so register each channel you subscribe to through the wpsignal_token_channels filter. Payload encryption is site-wide and is not a privacy boundary between users; the channel gate is.

Each plan has a monthly message quota. When it is reached the server answers publishes with "quota exceeded" and the plugin pauses publishing until the first day of the next month (UTC). The Connect tab on the WordSocket settings page shows this, as well as rejected credentials (disconnect and connect again) and an unreachable server, and clears the warning as soon as the server answers again. There is no admin notice.

The client falls back to SSE for receiving events. window.WPS.subscribe() and window.WPS.unsubscribe() work on SSE connections: channel changes are tracked and applied immediately via a lightweight SSE reconnect (50 ms debounce). Collaborative editing needs WebSocket, because SSE is receive-only: if the editor opens while the client is on SSE, collaboration stays off for that editor until the page is reloaded with WebSocket available. You can also disable the collaboration provider from the WordSocket Settings tab to use Gutenberg's HTTP polling for all editors instead.