內容簡介
AudiScale Connector 是一款專為 AudiScale 服務設計的外掛，能夠解鎖 WordPress 核心及標準 REST API 所不支援的 SEO 功能，特別是能夠在頁面標頭中添加 <meta name="description"> 標籤，而無需安裝其他 SEO 外掛。
【主要功能】
• 添加 SEO 標籤如 meta description 和 SEO title
• 管理重定向（301、302、410）
• 更新結構化資料（JSON-LD）
• 內容及媒體的狀態變更與草稿創建
• 讀取與指派分類法及術語
• 短期預覽草稿的簽名連結
外掛標籤
開發者團隊
原文外掛簡介
AudiScale Connector is the companion component for the hosted AudiScale service (https://audiscale.com). It unlocks the SEO actions that WordPress core and the standard REST API do not allow — most notably printing a tag in the
without forcing you to install another SEO plugin.Service disclosure (SaaS)
This plugin communicates with the third-party AudiScale service. No data is
sent until you have explicitly paired your site from your AudiScale dashboard.
Once paired, AudiScale can remotely apply a fixed catalog of operations
(listed below), each of which is:
signed with HMAC-SHA256 using a per-site secret (rotatable and revocable);
subject to a WordPress capability check (manage_options);
logged (who, what, when, before/after value);
reversible where possible (draft/revision, dry-run).
The plugin never executes arbitrary code: there is no code-evaluation
endpoint and no remote code download. “Almost everything” means an enumerated,
hand-coded, audited catalog.
Terms of service: https://audiscale.com/en/terms
Privacy policy: https://audiscale.com/en/privacy
Operation catalog
SEO /
: meta description, SEO title, canonical, robots, Open Graph, Twitter cards, native sitemap exclusionRedirects: create / update / delete (301, 302, 410)
Structured data: per-content JSON-LD
Content & media: field updates (via revision), draft creation, alternative text, status change (publish/draft only), move to trash and restore from it, listing of trashed contents
Taxonomies: read the taxonomies and terms a post type declares, assign existing terms to a content (never creates a term)
Site (read-only): robots.txt, public settings, content inventory, theme design system (global styles presets, theme supports, block patterns)
Draft preview: short-lived signed link rendering one draft in the real theme (never published, noindex)
Site (footer): marked HTML block printed on wp_footer (badge install / removal)
Plugins: inventory with update availability, forced update check, update of an installed plugin (the installed version is archived first), rollback to the archived version
Performance: preconnect / font preload hints, Google Fonts display=swap and self-hosting, removal of emojis / oEmbed / jQuery Migrate / Dashicons for visitors, script defer / async / delay until interaction, per-page removal of unused scripts and styles, scripts and styles inventory, server environment report — each one reversible, previewable before it goes live, and switched off at once from the Connection tab
Page builders: read and update a page in the builder it is edited with (Elementor, Divi, WPBakery, Beaver Builder), and create a new page directly in that builder
Crawl log (read-only): which pages search and AI crawlers request, with the HTTP status
Users (optional, see below): list the site’s users, change a role, sign a user out, revoke application passwords, send WordPress’s password-reset email, require a new password at next login, disable / re-enable login, delete with post reassignment
Connector: status, pairing, audit log
The plugin detects Yoast, Rank Math and SEOPress and stands down
automatically if one of them already manages the
tags.
Files downloaded to your site (performance features)
Only when AudiScale asks for it through a signed operation, never while a visitor
loads a page:
Google Fonts self-hosting (perf.fonts.set with selfHost): the plugin
downloads the Google Fonts stylesheets the site already uses from
fonts.googleapis.com and the font files they reference from
fonts.gstatic.com, into wp-content/uploads/audiscale-fonts/. Visitors then
load the fonts from your own domain, so their IP address is no longer sent to
Google on each page view. No other host is contacted, and no request carries
visitor data.
Plugin archives: once the site is paired, before any plugin update (from
AudiScale, from wp-admin or a WordPress auto-update), the installed version is
zipped into a private folder under wp-content/uploads/ (random folder and file
names, an index.php in every folder, closed to web access on Apache) so it can
be restored. One archive per plugin, deleted after 90 days; its SHA-256 checksum
is verified before any restore. Nothing is archived on a site that is not paired.
Crawl log
On a paired site, the plugin records the requests of known search and AI
crawlers (Googlebot, Bingbot, Applebot, Amazonbot, GPTBot, OAI-SearchBot,
ChatGPT-User, PerplexityBot, ClaudeBot, CCBot, Bytespider, meta-externalagent):
the crawler name, whether its identity was verified, the requested path
without its query string, the HTTP status and the time. No IP address, no
User-Agent string and nothing about human visitors is stored; a request that
does not come from a known crawler is never written.
Googlebot, Bingbot, Applebot and Amazonbot are verified the way their operators
document it (reverse DNS, then forward confirmation), cached one day under a
hashed key; a request that claims one of them and fails verification is dropped.
The other crawlers publish no such domain and are recorded as declared, not
verified. The log keeps 30 days and 30,000 rows at most, can be switched off
(and emptied) from “AudiScale → Connection”, and AudiScale reads it once a day
through the signed crawl.log.read operation. A suggested paragraph is added
to the WordPress privacy policy guide (Settings → Privacy).
The plugin never downloads or executes code: archives are only ever reinstalled
through the WordPress upgrader, from files the site itself produced.
Remote user management (optional, off by default)
Nothing here happens until the site owner explicitly turns on “user management”
for this site in AudiScale, and AudiScale then asks the owner to approve each
change before it sends it. What AudiScale can then do, on the current site only:
list the users: id, login, display name, email address, roles, registration
date, last login, two-factor status (Two Factor, Solid Security, WP 2FA or
Wordfence Login Security, when one of them is active), number of application
passwords, and whether the account is disabled or must choose a new password
(users.list, list_users);
change a user’s role (users.role.set, promote_users, limited to the roles
the connected account may itself assign);
sign a user out everywhere (users.sessions.destroy, edit_users);
revoke all of a user’s application passwords (users.app_passwords.revoke,
edit_users);
send WordPress’s own password-reset email to the user
(users.password_reset.send, edit_users);
require a new password at the next login, and sign the user out
(users.password_reset.force, edit_users) — lifted once the user resets
their password through “Lost your password?”;
disable and re-enable login (users.disable, users.enable, edit_users):
a disabled account can log in neither with its password nor with an
application password; its content is left untouched;
delete a user (users.delete, delete_users; on multisite, remove_users
and the user is only removed from this site), always reassigning their posts
to another active user of the site. A deletion cannot be undone.
AudiScale never sees, sends or sets a password: a reset always goes through
WordPress’s own email and the user’s own choice. User lists are fetched on
demand and not stored by AudiScale.
Each change is logged locally in the plugin’s audit log: the operation, the
target user id, the roles or flags before and after (for a deletion, the login,
its roles and the user receiving the posts), the WordPress user AudiScale acts
as, and the time. No email address and no password is ever logged.
Safeguards, enforced by the plugin whatever AudiScale asks:
the last administrator able to log in can be neither demoted, disabled nor
deleted;
the account AudiScale is connected with cannot have its role changed, be
disabled, be deleted or lose its application passwords;
on multisite, only a super admin can act on a super admin, and WordPress’s own
per-user capability checks always apply.
The login block and the forced reset live in user meta
(audiscale_login_disabled, audiscale_password_reset_required); deactivating
or uninstalling the plugin lifts them.
External services
This plugin connects to two external services.
AudiScale
The hosted AudiScale service (https://audiscale.com), which this plugin is the
companion of. Nothing is sent until an administrator pairs the site. Once paired,
AudiScale sends signed operation requests to the site, and after an update the
plugin sends the installed plugin version and the site URL back to AudiScale
(one request per version).
Terms of service: https://audiscale.com/en/terms
Privacy policy: https://audiscale.com/en/privacy
Google Fonts
Used only when AudiScale turns on Google Fonts self-hosting (perf.fonts.set with
selfHost), and only during that operation — never while a visitor loads a page.
The site’s server requests, from fonts.googleapis.com, the Google Fonts
stylesheets the site already loads, then, from fonts.gstatic.com, the font files
those stylesheets reference. The requests carry the server’s IP address and a
browser User-Agent string (Google only serves WOFF2 files to a browser it
recognizes); they carry no visitor data and no site data beyond the stylesheet URLs.
Afterwards visitors load the fonts from the site itself, so their IP address is no
longer sent to Google.
Google Terms of Service: https://policies.google.com/terms
Google Privacy Policy: https://policies.google.com/privacy
Google Fonts FAQ (privacy): https://developers.google.com/fonts/faq/privacy
