Fixes active plugins being left deactivated after an update run from Unifyca, and lets the connector keep itself up to date. Recommended for every connected site.<\/p>","2.0.8":"
More accurate identification of WordPress.org plugins and themes versus premium or custom ones. Backward compatible.<\/p>","2.0.7":"
Fixes plugins being shown as up to date right after one of them was updated. Backward compatible.<\/p>","2.0.6":"
Fixes the Site Health directory sizes (WordPress, uploads, themes, plugins, database, total) showing "Loading\u2026" instead of the real value. Sizes are now computed during the audit. Backward compatible.<\/p>","2.0.5":"
Fixes administrator "last login IP" detection on sites behind Cloudflare, reverse proxies or managed hosting, where the server\/proxy IP was stored instead of the real admin IP. Resolution stays fully local (no external lookup). Backward compatible.<\/p>","2.0.4":"
WordPress.org compliance: location handling now uses the WordPress API (no Restores the automatic "disable file editor" fix using a runtime define (no wp-config.php changes, nothing written to disk). WP_DEBUG stays manual. Backward compatible.<\/p>","2.0.2":" Compliance update from the WordPress.org manual review: cURL replaced with the WP HTTP API, no automatic wp-config.php edits (now a manual recommendation), ZIP-only file backups, and no server path disclosure. Backward compatible.<\/p>","2.0.1":" Compliance and security update. Removes external IP lookups and the custom self-updater, hardens backup storage, and locks down REST endpoints with dedicated permission checks. Fully backward compatible \u2014 connected sites keep working without re-pairing.<\/p>","2.0.0":" Major redesign. The plugin now ships a full website audit dashboard inside wp-admin in addition to the existing Unifyca SaaS connector. The REST API, HMAC validation and SaaS sync payload remain fully backward compatible \u2014 existing connected sites continue to work without re-pairing.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3587073,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3587073,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3590387,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.0.4","2.0.9"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"The audit dashboard hero, showing the overall score, per-category scores and severity counters.","2":"The Security tab with a list of issue cards, each with a severity badge, explanation and recommended action.","3":"The Connect to Unifyca tab where administrators can copy the connection token to pair the site with the Unifyca SaaS."}},"plugin_section":[],"plugin_tags":[8642,268971,10710,41933,185881],"plugin_category":[],"plugin_contributors":[268972],"plugin_business_model":[],"class_list":["post-329370","plugin","type-plugin","status-publish","hentry","plugin_tags-security-audit","plugin_tags-website-documentation","plugin_tags-wordpress-backup","plugin_tags-wordpress-management","plugin_tags-wordpress-monitoring","plugin_contributors-unifyca","plugin_committers-unifyca"],"banners":{"banner":"https:\/\/ps.w.org\/unifyca-audit-connector\/assets\/banner-772x250.png?rev=3590387","banner_2x":"https:\/\/ps.w.org\/unifyca-audit-connector\/assets\/banner-1544x500.png?rev=3587073","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/unifyca-audit-connector\/assets\/icon-256x256.png?rev=3587073","icon_2x":"https:\/\/ps.w.org\/unifyca-audit-connector\/assets\/icon-256x256.png?rev=3587073","generated":false},"screenshots":[],"raw_content":"\n Unifyca Audit Connector<\/strong> is a WordPress audit and monitoring plugin that can optionally connect to Unifyca, a WordPress Website Management and Website Documentation platform for agencies and freelancers.<\/p>\n\n Works locally.\nNo account required.\nConnect to Unifyca only if you want centralized WordPress management and website documentation.<\/p>\n\n The plugin is designed for:<\/p>\n\n The audit logic runs entirely on your own server. No site data leaves WordPress unless you explicitly connect the site to the Unifyca SaaS (described below). You can use the plugin for free, locally, without creating an account.<\/p>\n\n Complete documentation, setup guides and screenshots:\nView the documentation<\/a><\/p>\n\n Security<\/strong><\/p>\n\n Maintenance<\/strong><\/p>\n\n SEO<\/strong><\/p>\n\n Privacy & compliance<\/strong><\/p>\n\n Unifyca is a WordPress Website Management platform.<\/p>\n\n It centralizes:<\/p>\n\n \u2022 WordPress maintenance\n\u2022 Website monitoring\n\u2022 Backups\n\u2022 Website documentation\n\u2022 Hosting & domains\n\u2022 Credentials\n\u2022 Client reports<\/p>\n\n Everything around your websites in one place.<\/p>\n\n Manage multiple WordPress websites from one dashboard.<\/p>\n\n You can connect the site to the Unifyca SaaS at unifyca.com<\/a> for centralised WordPress maintenance:<\/p>\n\n Connecting is fully optional. The plugin will continue running local audits even if you never create a Unifyca account.<\/p>\n\n This plugin can optionally connect to Unifyca<\/strong>, a Software-as-a-Service (SaaS) platform for WordPress website management and documentation. The connection is never automatic<\/strong>: it requires an explicit administrator action (pasting the connection token generated by the plugin into the Unifyca dashboard). Until you do that, the plugin runs entirely locally and contacts no external service.<\/p>\n\n When the site is connected, the plugin communicates with the Unifyca SaaS over these domains:<\/p>\n\n Unifyca lets agencies and freelancers manage many WordPress sites from one place: it runs remote audits, applies administrator-approved fixes, runs and stores backups, monitors uptime, and keeps maintenance history and documentation. The connector exposes a set of HMAC-authenticated REST endpoints that the Unifyca SaaS calls to provide these features.<\/p>\n\n When you disconnect the site, the confirmation dialog offers an optional<\/strong> \"what made you disconnect?\" reason and comment. Only if you fill one of those fields in and submit, the plugin sends a single non-blocking HTTPS POST to This plugin performs a local WordPress audit. Connecting the site to the Unifyca SaaS at unifyca.com is entirely optional and requires explicit administrator action. Local audits do not contact any external service; external communication only occurs after the administrator explicitly connects the site to Unifyca.<\/p>\n\n The plugin writes a small set of options and user metas inside your WordPress database:<\/p>\n\n When the site is connected to Unifyca, this information may be transmitted to the Unifyca service to generate security alerts related to administrator account activity. The information is not used for advertising or profiling purposes.<\/p>\n\n All of the above are removed on plugin uninstall.<\/p>\n\n The plugin does not transmit any data to Unifyca unless an administrator explicitly connects the site.<\/p>\n\n When connected, the plugin sends audit results and connection metadata required for the Unifyca service to operate.<\/p>\n\n The plugin does not send:<\/p>\n\n Disconnecting the site stops future transmissions. Uninstalling the plugin removes all locally stored data listed above.<\/p>\n\n The local audit does not contact any third-party service. The plugin no longer performs an external public-IP lookup: the server IP reported in the audit is resolved locally from the web server environment only ( The only external service the plugin can communicate with is the Unifyca SaaS<\/strong>, available at unifyca.com<\/a> and app.unifyca.com<\/a>, and only after the administrator explicitly connects the site.\nSee the External services<\/em> section above for full details, including the service domains, Terms of Service and Privacy Policy.<\/p>\n\n Plugin and theme updates requested from Unifyca \u2014 including an update of this plugin itself \u2014 are installed through WordPress's own update system, which downloads the package from the WordPress.org plugin directory exactly as wp-admin does. The plugin never downloads code from Unifyca or from any other location.<\/p>\n\n When you disconnect the site from Unifyca through the Connect to Unifyca<\/strong> tab, the confirmation modal exposes an optional<\/em> \"what made you disconnect?\" reason selector with a short comment field. Submitting it is never required to disconnect.<\/p>\n\n No personal user data is sent automatically.<\/strong> The connected site URL and the optional feedback reason\/comment may be shared with Unifyca only<\/strong> when you explicitly submit the disconnect feedback form. The site URL is included because, in some setups, it can identify a business or organisation; we are upfront about this so you can decide whether to submit feedback at all.<\/p>\n\n If \u2014 and only if \u2014 you fill in one of those fields, the plugin sends a single non-blocking HTTPS POST to https:\/\/app.unifyca.com\/ajax\/wp-disconnect-feedback.php containing: the selected reason code, the optional comment (up to 500 characters), the site URL, the connection token (so Unifyca can match the entry to the correct tenant), and the plugin version.\nThe connection token is transformed into a non-reversible representation before storage. The connection token is never stored in its original form.<\/p>\n\n The connection token is the only stable identifier the plugin holds for the connected tenant \u2014 the handshake does not store a separate Unifyca tenant\/project\/site ID. The shared secret is deliberately never included in this payload.<\/p>\n\n The request is fire-and-forget: if it fails, the disconnect still completes normally. Nothing else is transmitted at this step.<\/p>\n\n If the administrator pastes the connection token into Unifyca, the SaaS gains the ability to call the connector's REST endpoints. From that moment on, the standard audit payload is transmitted to Unifyca when the SaaS triggers a sync. The payload contains:<\/p>\n\n The plugin never sends database contents, post content, page content, user passwords, or commercial data to any third party.<\/p>\n\n If the administrator disconnects the site (from the Connect to Unifyca<\/strong> tab), the shared secret is wiped and no further data can be sent to the SaaS until a new pairing is performed.<\/p>\n\n None. The plugin does not run analytics, fingerprinting, scheduled \"phone home\" calls or any background data collection. Local audits make no outbound requests to external services. Every outgoing request to Unifyca falls into one of two explicit categories:<\/p>\n\n No personal user data, post content, page content, comment bodies or user passwords are ever transmitted in any of these cases.<\/p>\n\n Complete documentation is available online:<\/p>\n\n The documentation includes setup guides, audit explanations, backup features, privacy details and troubleshooting information.<\/p>\n\n This plugin is distributed under the GPL v2 or later. All assets (CSS, JavaScript, SVG) included in the plugin ZIP are the unminified, human-readable source.<\/p>\n\n\n WordPress Website Management is the practice of centralizing updates, audits, monitoring, backups and the infrastructure around websites.<\/p>\n\n Unifyca combines:<\/p>\n\n Everything around your websites in one place.<\/p><\/dd>\n No. Local audits are read-only. No changes are made unless an administrator explicitly performs an action.<\/p><\/dd>\n No, not unless you explicitly connect the site to the Unifyca SaaS through the Connect to Unifyca<\/strong> tab.<\/p>\n\n When not connected<\/strong>, the local audit performs no outbound requests to any external service. The only network requests it can make are HTTPS loopback requests to your own site URL (to read the homepage HTML and to check whether files like No site contents, no posts, no users, no credentials and no audit results are transmitted anywhere unless the site is explicitly connected. See the External services<\/em> section below for what happens once you connect.<\/p><\/dd>\n Only on explicit action:<\/p>\n\n There is no scheduled or background audit. There is no telemetry.<\/p><\/dd>\n Yes. The local audit dashboard works fully without a Unifyca account. The Connect to Unifyca<\/strong> tab is purely optional.<\/p><\/dd>\n Only users with the The audit performs HTTP checks against your own site URL (homepage, sensitive paths) and synchronously calculates Site Health values. These checks are intentionally local and can take a few seconds on larger installations. Run the audit when you want fresh results \u2014 the dashboard does not auto-refresh.<\/p><\/dd>\n The plugin penalises each detected issue based on severity (Critical, High, Warning, Info) and shows you exactly which checks contributed.<\/p>\n\n When the site is not connected<\/strong> to Unifyca, the dashboard exposes per-category tabs (Security, Maintenance, SEO, Privacy) with the full local list of findings and explanations.<\/p>\n\n When the site is connected<\/strong> to Unifyca, the wp-admin dashboard becomes a lightweight companion view and the detailed breakdown, fix history and automation live in the Unifyca dashboard.<\/p><\/dd>\n Yes. When you delete the plugin from wp-admin \u2192 Plugins, the No. The audit helps detect and explain a number of common operational and security issues, but it cannot guarantee that a site is secure. Treat the findings as a checklist to review and improve \u2014 not as a certification.<\/p><\/dd>\n\n<\/dl>\n\n\nWP_CONTENT_URL<\/code> \/ WP_PLUGIN_DIR<\/code> path building, no ABSPATH<\/code> disk-probe fallback), and database backups are stored as a protected ZIP archive only. Backward compatible.<\/p>","2.0.3":"\n
What the local audit checks<\/h4>\n\n
\n
WP_DEBUG<\/code>) running on production<\/li>\nwp-config.php<\/code>, .env<\/code>, .git\/<\/code>)<\/li>\nadmin<\/code> username with administrator role<\/li>\ndebug.log<\/code> file present in wp-content\/<\/code><\/li>\n<\/ul>\n\n\n
wp_options<\/code><\/li>\n<\/ul>\n\n\n
\n
What you get for free, locally<\/h4>\n\n
\n
What is Unifyca?<\/h4>\n\n
What Unifyca SaaS adds (optional)<\/h4>\n\n
\n
What this plugin is not<\/h4>\n\n
\n
External services<\/h3>\n\n
Service and domains<\/h4>\n\n
\n
What the service does<\/h4>\n\n
What data is sent, and when<\/h4>\n\n
\n
WP_DEBUG<\/code> and XML-RPC state, locally-resolved server IP); the WordPress Site Health diagnostic report (the same information WordPress exposes under Tools \u2192 Site Health \u2192 Info: configuration constants, database charset, directory sizes and file-system writability \u2014 with absolute server paths such as ABSPATH and WP_CONTENT_DIR removed); administrator account metadata (ID, login, email, display name, registration date and a one-way SHA-256 fingerprint of the password hash \u2014 never the hash itself); pending comment counts; and audit findings. Administrator login metadata (timestamp and IP of the last login) may be transmitted only when required for the security-monitoring features.<\/li>\nOptional disconnect feedback<\/h4>\n\n
https:\/\/app.unifyca.com\/ajax\/wp-disconnect-feedback.php<\/code> containing the selected reason code, the optional comment (max 500 characters), the site URL, the connection token (so Unifyca can match the entry to the correct account) and the plugin version. Submitting feedback is never required to disconnect, and nothing is sent if you leave the fields empty.<\/p>\n\nTerms and privacy<\/h4>\n\n
\n
Privacy<\/h3>\n\n
Data the plugin stores locally<\/h4>\n\n
\n
unifyca_connection_token<\/code>, unifyca_token_status<\/code>, unifyca_shared_secret<\/code>, unifyca_connection_status<\/code>, unifyca_connected_at<\/code> \u2014 connection state, only populated when the site is connected to Unifyca.<\/li>\nunifyca_prev_admin_ids<\/code> \u2014 list of administrator user IDs at the time of the last audit; used internally to detect newly added administrators between audits.<\/li>\nunifyca_disable_xmlrpc<\/code> \u2014 set to 1 when an administrator chose to disable XML-RPC through a connector fix action.<\/li>\nunifyca_last_local_audit_at<\/code> \u2014 ISO timestamp of the last local audit.<\/li>\nunifyca_last_privacy_lite_scan<\/code> \u2014 structured result of the last lightweight privacy review (counts and a few sample relative paths, never metadata values).<\/li>\nunifyca_last_privacy_lite_scan_at<\/code> \u2014 ISO timestamp of the last lightweight privacy review.<\/li>\nunifyca_disconnect_feedback_log<\/code> \u2014 rolling local log of the last 20 disconnect feedback submissions (reason code, optional comment, site URL, connection token at the time, plugin version, ISO timestamp). Only written when the administrator submits the optional disconnect feedback form. Always available for inspection via WP-CLI: wp option get unifyca_disconnect_feedback_log --format=json<\/code>.<\/li>\n_unifyca_last_login_at<\/code>, _unifyca_last_login_ip<\/code> (user metadata) \u2014 timestamp and IP of the most recent successful login for administrator users only. Used to flag suspicious administrator activity.<\/li>\n<\/ul>\n\nData sent to Unifyca<\/h4>\n\n
\n
Third-party services used by the plugin<\/h4>\n\n
SERVER_ADDR<\/code> \/ hostname). When public IP detection is needed, it is handled server-side by Unifyca after the site has been connected.<\/p>\n\nOptional disconnect feedback<\/h4>\n\n
Data sent to the Unifyca SaaS (only when the site is connected)<\/h4>\n\n
\n
WP_DEBUG<\/code>, XML-RPC enabled state, locally-resolved server IP \u2014 no external IP lookup is performed).<\/li>\nTelemetry and automatic data collection<\/h4>\n\n
\n
Documentation<\/h3>\n\n
\n
Source code<\/h3>\n\n
\n
wp-content\/plugins\/<\/code>.<\/li>\nRequirements<\/h4>\n\n
\n
curl<\/code> extension recommended (used to read the homepage HTML when checking SEO heading structure)<\/li>\n\n
What is WordPress Website Management?<\/h3><\/dt>\n
\n
Does the plugin modify my site automatically?<\/h3><\/dt>\n
Does this plugin send my data anywhere?<\/h3><\/dt>\n
wp-config.php<\/code> respond publicly).<\/p>\n\nHow is the audit triggered?<\/h3><\/dt>\n
\n
\/wp-json\/unifyca\/v1\/audit<\/code> (this happens only when the site is connected).<\/li>\n<\/ul>\n\nCan I keep using the plugin without creating a Unifyca account?<\/h3><\/dt>\n
What user role can run the audit?<\/h3><\/dt>\n
manage_options<\/code> capability (typically administrators). All admin actions and the AJAX endpoint validate this capability and a WordPress nonce on every request.<\/p><\/dd>\nWhy does the audit take a few seconds?<\/h3><\/dt>\n
Why is the score for one of my sites not 100?<\/h3><\/dt>\n
Can I uninstall the plugin without leaving residual data?<\/h3><\/dt>\n
uninstall.php<\/code> script runs and removes every option and user meta value the plugin has stored. No data remains.<\/p><\/dd>\nDoes this plugin guarantee my site is secure?<\/h3><\/dt>\n
2.0.9<\/h4>\n\n
\n
2.0.8<\/h4>\n\n
\n
2.0.7<\/h4>\n\n
\n
2.0.6<\/h4>\n\n
\n
WP_Debug_Data::get_sizes()<\/code> and uses the resulting values whenever available, instead of relying on the internal loading...<\/code> placeholder marker. On large sites the audit may take a few extra seconds while the sizes are calculated.<\/li>\nwp-header-end<\/code> marker so core moves notices below the page header.<\/li>\n<\/ul>\n\n2.0.5<\/h4>\n\n
\n
2.0.4<\/h4>\n\n
\n
content_url()<\/code>, and other plugins' on-disk size is measured by deriving the plugins root from plugin_dir_path()<\/code> on the main file rather than WP_PLUGIN_DIR<\/code>.<\/li>\nwp_upload_dir()<\/code> cannot be resolved the probe is skipped.<\/li>\ndatabase.zip<\/code>) only. The raw SQL is streamed to a temporary file (wp_tempnam()<\/code>), added to the ZIP, and deleted immediately in both success and failure paths \u2014 a loose database.sql<\/code> is never left on disk. ZIP support is required; there is no loose-SQL fallback.<\/li>\nABSPATH<\/code> token from user-facing error messages.<\/li>\n<\/ul>\n\n2.0.3<\/h4>\n\n
\n
define()<\/code> on every request from the plugin bootstrap \u2014 wp-config.php is never modified, no file is written to disk and an existing definition is never overridden.<\/li>\n2.0.2<\/h4>\n\n
\n
wp_remote_get<\/code>).<\/li>\n.bak<\/code> or config files are ever written.<\/li>\nUNIFYCA_PLUGIN_URL<\/code> constant and tidied file\/directory location handling; writable storage always uses wp_upload_dir()<\/code>.<\/li>\n<\/ul>\n\n2.0.1<\/h4>\n\n
\n
api.ipify.org<\/code>). Local audits now make no outbound requests to any external service; the server IP is resolved locally only.<\/li>\nupdate_plugins<\/code> site transient.<\/li>\nwp-content\/uploads\/unifyca-backups\/<\/code> (via wp_upload_dir()<\/code>), always protected with an index.php<\/code> and a deny-all .htaccess<\/code>. Core backups are written as a single ZIP archive \u2014 the plugin never leaves loose, web-accessible PHP files (e.g.