ZeroPress Static

No. You can prepare and download both files, then use them in a WXR starter project yourself. Publish to GitHub requires a repository, an existing branch and a registered token.

It is required when comment writing is enabled. Otherwise, you can leave it blank. The default build then omits sitemap.xml, feed.xml and the <link rel="canonical"> tag that identifies the page's preferred URL. RSS also needs this URL even when its checkbox is enabled.

Yes. With a static site URL set, the exported WXR uses it for the site addresses, post and page links, and menu links within the WordPress site's address. Paths relative to the WordPress home address are retained, removing any installation subdirectory. Queries and fragments are preserved. With the setting blank, the WXR retains the WordPress addresses. Links within article bodies keep their saved addresses. Media URLs follow the media replacement rules, and comments use the configured WordPress REST API URL.

When unchecked (the default), Disallow: / is written to the static site's robots.txt. Enabling it writes Allow: /. A custom public/robots.txt in the build project overrides the generated default. Access to a private site is managed by your hosting.

Published posts and pages without passwords, their used categories and tags, public author display names, selected classic menus and required media metadata. Drafts, private or scheduled content, comment records, login names, user email addresses and arbitrary post metadata are excluded. Saved HTML and static block markup are exported. Shortcodes, dynamic blocks and page builders are not executed. Custom post types and block navigation are not converted. Excerpts and taxonomy descriptions use plain text.

Each preparation, download and publication is a separate request. Downloads and publication regenerate the data. The plugin requests WordPress's administrator memory allowance (WP_MAX_MEMORY_LIMIT) and checks the effective PHP memory_limit, allowing headroom for data processing and GitHub transport. Increase the server memory allowance if the export needs more memory. A positive PHP max_execution_time gives each request a shared wall-clock budget of that duration minus five seconds, including WordPress startup and GitHub communication. A value of 0 leaves the overall budget unlimited. PHP-FPM, web server and proxy limits apply separately. GitHub requests use the remaining budget, or default to 30 seconds each when PHP has no time limit. Developers can adjust that timeout using the zeropress_static_github_request_timeout filter; a finite overall budget still applies. See the repository README for an example. Resource errors show the applicable limits. If a publication response is lost, check GitHub before preparing again.

Yes. In Settings → API protection, enable Restrict public REST API access (default: off). With comment display off, all unauthenticated REST requests are blocked. With comment display on, only the three comment APIs are allowed: /wp-json/wp/v2/comments (GET/POST), /wp-json/zeropress-static/v1/comments/policy (GET), and /wp-json/zeropress-static/v1/comments/challenge (POST). Read HEAD requests and CORS OPTIONS requests are supported. Client-supplied rest_route query and form fields are also blocked on unauthenticated REST requests. Valid WordPress REST authentication retains normal permissions; a login cookie alone requires a REST nonce. Saving API protection or comment display settings changes API access immediately. Other plugins using public REST APIs may be affected. Pages, media and non-REST endpoints are unaffected. Clear existing REST caches and exclude REST responses from CDN or server caching.

In Settings → Menus, assign classic WordPress menus to primary, footer or custom IDs used by your static theme. Only selected menus are exported. Create and edit them with WordPress's classic menu editor; the plugin's assignments are independent of WordPress theme locations.

Media replacement rules change matching URL prefixes in the exported content and media metadata. The longest matching source wins, and each value is replaced once. Ordinary article links retain their addresses. Media files remain at their existing locations; the replacement URLs must serve those files to site visitors. The WordPress Site Icon supplies the favicon and Apple touch icon. Both URLs use the saved replacement rules. With no Site Icon set, the build project's icon defaults remain in place.

Yes. Enable comment display and leave writing disabled. The blog theme shows the list without a form or reply buttons. Both options start off. Writing requires a saved static site URL. It uses a proof-of-work check by default, or Cloudflare Turnstile when selected and configured with keys for the static site's hostname. WordPress's existing comment policies still apply. The API must be accessible to visitors, even if the WordPress admin is private. Comment display and API URL changes require republishing. Writing and Turnstile settings apply when the theme next checks the writing policy. The usage guide lists the required API paths and origin checks. Each IP address is limited to 60 challenge requests and 5 ZeroPress comment or reply submission attempts per minute, across all posts. Failed verification attempts count, and limits apply before PoW or Turnstile verification. Quotas reset at each minute boundary. Requests over the limit receive HTTP 429 and a retry delay; comment reading is unaffected. Behind a proxy, the trusted web server must supply the visitor's IP address in PHP's REMOTE_ADDR to give each visitor a separate quota. Temporary counters use a keyed hash of the address.

No. Newsletter connection displays a signup prompt for a page you prepare with a newsletter service. Supply a signup page URL, an embedded signup page URL or both. The service handles subscriptions and mail delivery. The embedded page must allow iframe display.

Yes. When the data matches the previous publication, no further publication is needed. To publish intentionally, open ZeroPress → Publish, expand Republish options, and select Publish to GitHub again. This updates the WXR generation time and creates a new commit. Post dates and build settings remain unchanged. This can trigger your repository's build service.

If GitHub's response to the branch update is inconclusive, the plugin attempts one read-back within the remaining request time, without repeating the write. A lost browser response or a terminated server request may prevent confirmation. If it reports Publication needs verification, inspect the publishing branch before preparing and publishing again.

GitHub tokens and Turnstile secrets use authenticated encryption derived from WordPress secrets. Their plaintext is not returned to the admin screen. If the WordPress secrets change, register the credentials again. Deactivation retains configuration; uninstall removes the plugin's settings, credentials and temporary verification records.